ChatGPT AgentForger: One Link Creates a Rogue Agent

What is AgentForger?

It is the name Zenity Labs gave to a critical flaw in OpenAI's ChatGPT Workspace Agents. According to The Hacker News, which classifies it as a cross-site request forgery (CSRF), the Agent Builder accepted an initial state passed through URL parameters, including an agent template and a prompt. The injected prompt was submitted and run automatically when the page loaded: an instruction placed in a URL became the agent's first command.

Zenity sums up the attack in one sentence: a single link could "hijack OpenAI's ChatGPT Agent Builder" to create an attacker-controlled agent.

What conditions did the victim have to meet?

Three, per the article: be logged into ChatGPT, have access to Workspace Agents, and have at least one authorized connector, such as Outlook, Gmail, Google Calendar, Google Drive, Slack or Teams. The attacker sends a phishing link; opening it is enough, with no other interaction.

What could the forged agent do?

According to Zenity, as reported by The Hacker News, the agent could:

• attach all existing connectors and set them to run without approval;
• run every hour, which serves as a persistence mechanism;
• check for emails from an attacker address with subjects starting with "TASK", carry out the requested tasks and send the results back;
• perform reconnaissance, harvest sensitive documents from cloud storage and extract passwords shared in Slack;
• impersonate the victim on Teams to send phishing links, which opens the way to credential theft and business email compromise.

Mike Takahashi of Zenity calls it "an agent trust failure": the platform assumed the user had intentionally created and approved the agent.

Why does the impact exceed that of a classic CSRF?

A traditional CSRF forces a one-off action. Here it creates an autonomous worker that acts over time with the victim's identity. Three properties explain the severity.

1. Persistence: the agent keeps running once the phishing page is closed, and the attacker does not need to maintain a session.
2. Inherited trust: the agent acts under the employee's identity, so downstream systems see legitimate activity.
3. Approvals off: disabling human approvals makes the action silent.

What is the state of the fix?

OpenAI addressed the issue as of June 8, 2026, following responsible disclosure by Zenity. The company also announced that Agent Builder will be retired effective November 30, 2026 in favor of the Agents SDK and Workspace Agents. If you could have been a target, review agents created around that period.

What can administrators of an organization using these agents do?

Even after the fix, a few measures reduce exposure to this kind of scenario, whether the product is OpenAI's or another.

• Inventory existing agents: who created them, when, with which connectors, with or without approval, and what schedule.
• Limit allowed connectors: leave connectable only the services the agent truly needs, read-only when possible.
• Require human approval for sending messages, sharing documents and any write, and prevent users from disabling it.
• Monitor agent creations and the automatic emails or messages leaving the organization, especially those whose subject follows a repeated pattern.
• Raise awareness: a link to an AI tool is still a link. Messages inviting you to click to "configure" or "activate" an assistant should be treated as phishing.
• Review regularly the access granted to agents and revoke what is no longer used.

These points apply to any assistant connected to mail, document storage and team tools.

It is also worth running a small exercise: ask a colleague to send a harmless test link to a few volunteers and see who ends up with a new agent in their workspace, and whether anyone notices. The exercise reveals both the technical gaps and the human reflexes, and it gives you a concrete baseline to improve against each quarter.

What should you do if you build an agent feature?

The flaw is a design textbook case, applicable to any product that lets users create agents from a web interface.

1. No side-effect action on a mere URL load. URL parameters may prefill a form, never submit or run it without an explicit user gesture.
2. CSRF protection on every state-changing request: anti-CSRF tokens and strict SameSite cookies, not just origin checks.
3. Separate "create" from "authorize". Building an agent and granting it access to production data are two distinct actions, each requiring explicit consent.
4. Server-enforced approvals for high-risk tools (external sending, billing, deletion). The agent's creator must not be able to disable them from the UI.
5. Inventory and detection: list every active agent in the organization, its creator, its connectors and its schedule, and alert on agents created outside usual patterns (time, source, no interaction).
6. Visible warning: show what an agent can do before activating it, with the list of connectors and rights.

How do you test a product that creates agents?

With a test account and authorization, try to cause an agent to be created without a user gesture.

1. URL parameters: identify those that prefill the builder's state (template, prompt, connectors). Is a prompt present in the URL run on load?
2. CSRF protection: from another domain, forge a request to create, authorize and disable approval. Each request must fail without a valid token.
3. Separate consent: verify that a connector cannot be attached to a new agent without explicit consent.
4. Approvals: verify that a risky action always requires approval, whatever the agent's setting.
5. Scheduling: can an agent schedule itself to run at regular intervals? Where does the user see it?
6. Detection: does creating an agent generate a message to the user and a trace for the administrator?

The AI agent red teaming page and the AI agent security page describe this approach.

What should you keep in mind?

As soon as a product lets users create autonomous workers that act on their behalf, every old web vulnerability (CSRF, IDOR, XSS, SSRF) sees its impact multiplied. The defense is to apply old controls with the seriousness the new surface demands. CleanIssue's Agent Red Team Express (EUR 1,900, 5 days) tests agent creation, authorization and rights in your product: see the offer. The discovery call, 30 minutes and free, is there to examine which links a user can click to create an agent unknowingly.

Further reading

• agent sessions stolen by infostealers