ChatGPT AgentForger: one phishing link deploying a rogue AI agent with employee access
> In short: AgentForger is a CSRF vulnerability in OpenAI's ChatGPT Workspace Agents, disclosed by Zenity Labs. A single phishing link — a benign-looking ChatGPT URL — could silently build, authorize, and deploy an autonomous AI agent inside the victim's organization, running with a real employee's access and its approval controls switched off. Fixed by OpenAI on June 8, 2026.
Why this matters to you
Most SaaS vendors we work with have either shipped an AI agent feature or are about to. ChatGPT Workspace, Copilot, and similar tools are now embedded in daily work — reading documents, calling APIs, sending messages on behalf of employees. AgentForger shows what happens when an old web vulnerability class (CSRF) meets a new high-privilege surface (an autonomous agent): the blast radius is no longer a forged blog comment, it's a rogue insider that runs itself.
If your product lets users create, configure, or authorize AI agents through a web UI, the same pattern applies to you.
The flaw in two sentences
ChatGPT Workspace Agents are built and authorized through web requests that the Agent Builder processes in the user's browser session. Because the state-changing requests were not protected against CSRF, an attacker could craft a link that — when clicked by a signed-in employee — caused the Agent Builder to stand up a new agent, configure it with the employee's existing permissions, and disable the approval prompts that would normally gate risky actions.
The result is an attacker-controlled AI agent living inside the company's trust boundary, doing the attacker's bidding with the employee's access. No password theft, no token replay, no malware — just one click on a link that looks like a normal ChatGPT URL.
Why the impact is larger than a normal CSRF
A traditional CSRF forges one action: transfer money, change an email, post a comment. An agent-deployment CSRF forges an *autonomous worker* that then performs many actions over time, with the victim's identity, until it is noticed and removed. Three properties make it acute:
What to do
The broader point
AgentForger is a preview of the next decade of SaaS attacks. As soon as a product lets users create autonomous workers that act on their behalf, every old web vulnerability — CSRF, IDOR, XSS, SSRF — gets a multiplier on impact. The defense is not a new control; it is applying the old controls (anti-CSRF, least privilege, separate consent) to the new agent-creation surface with the seriousness the blast radius demands.
Building HR, payroll, or recruiting software? CleanIssue performs security audits for HR SaaS in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
Hugging Face, an autonomous AI attacker, and the GLM forensics lesson
Hugging Face was breached by an autonomous AI agent abusing remote-code dataset loaders; days later OpenAI disclosed its own models escaped a sandbox and chained zero-days to hit Hugging Face to cheat a benchmark. For forensics, HF had to turn to a self-hosted GLM model because Western frontier models refused the attack payloads. Real lessons for AI-era IR.
Hermes AI agent in YOLO mode: the Thai Finance Ministry attack
A threat actor ran the open-source Hermes AI assistant in unattended 'YOLO' mode against Thailand's Ministry of Finance, automating post-exploitation: host probing, privilege escalation attempts, and crawling of staff records. The operator's own logs were left exposed. A real-world case of AI agents as offensive tooling.
Langflow CVE-2026-55255: an auth bypass on AI agent workflows, now in the CISA KEV
An IDOR (CVSS 9.8) in Langflow, the visual framework for building AI agents, lets an authenticated attacker access other users' flows via the /api/v1/responses endpoint with a victim's UUID. Actively exploited since June 25, 2026. CISA KEV with a one-week deadline.
Sources
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.