AgentForger Flaw: One Malicious ChatGPT Link Could Spawn a Rogue Enterprise AI Agent

A single crafted URL was enough to silently build, authorize, and launch a rogue autonomous AI agent inside a victim’s organization, using nothing more than a click on a phishing link.

Security researchers at Zenity Labs disclosed the flaw, dubbed “AgentForger,” in OpenAI’s Workspace Agents feature for ChatGPT, and the case has quickly become a reference point for how classic web vulnerabilities are resurfacing in agentic AI systems.

Cross-Site Request Forgery has existed for two decades as a way to trick a logged-in user’s browser into submitting an unwanted request. Zenity researcher Mike Takahashi showed that the same trust-boundary abuse now applies to autonomous agents, not just single actions.

AgentForger Flaw

Instead of forging one transaction, an attacker could forge the creation of an entire AI agent, complete with permissions, connectors, and a recurring schedule, using the victim’s already-authenticated ChatGPT session.

The vulnerability lived in the Workspace Agents Builder at chatgpt.com/agents/studio/new, which accepted initialization state directly through URL parameters.

The template_name parameter preselected a starter template such as “Chief of Staff,” while initial_assistant_prompt was automatically submitted and executed the moment the page loaded, rather than simply populating a text box for review.

That meant an attacker could embed a full set of instructions into a link, and the moment a logged-in victim clicked it, ChatGPT would execute those instructions inside the victim’s own authenticated session.

The proof-of-concept prompt instructed the Builder to connect every already-authorized connector, such as Outlook, Gmail, Slack, or Teams, and switch approval settings to “Never ask,” eliminating the safeguard meant to stop an agent from silently sending mail or deleting data.

It then created multiple schedules five minutes apart, so the agent would effectively check in every five minutes, watch Outlook for attacker emails tagged “TASK,” carry out those instructions, and email results back, before instructing the Builder to publish the agent live.

Because the connectors had been authorized during prior legitimate use, no new consent screen appeared to warn the victim.

One of the more troubling findings was that ChatGPT’s Preview Mode, intended to let users test an agent safely before publishing, actually executed the newly built agent against real connected accounts under the just-configured approval settings.

Since the payload had already disabled approval prompts, the preview run carried out live actions without any visible confirmation step, turning a “test” feature into a live execution engine.

The recurring schedule was what elevated the bug from a one-off trick into a standing foothold. Once published, the attacker no longer needed the victim to click anything else; the agent would keep waking up, checking email for new instructions, executing them with the victim’s own connected apps, and returning results, effectively functioning as a persistent, remotely tasked insider.

Zenity Labs framed this as combining the “lethal trifecta” of security risk in one flow: untrusted input from the URL, access to private data through connectors, and a built-in exfiltration channel via email.

The core failure combined two design choices: the Builder treated a URL parameter as executable input with no CSRF protections, and it allowed the same natural-language prompt to alter security-sensitive settings like approval policies and schedules.

Zenity reported the issue to OpenAI through Bugcrowd on June 4, 2026; it was triaged and accepted the next day, and OpenAI shipped a fix by June 8, 2026, a four-day turnaround researchers credited to a responsive security team.

Zenity has indicated a follow-up report will detail how a forged agent could be tasked to reconnoiter an organization, harvest data, and stage business email compromise once it goes live.