Cybersecurity researchers have unveiled a critical vulnerability in **OpenAI**'s **ChatGPT Workspace Agents** that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence (AI) agent inside a victim's organization. The vulnerability, codenamed **AgentForger** by **Zenity Labs**, has since been addressed by **OpenAI** as of June 8, 2026, following responsible disclosure. "A single link could hijack **OpenAI**'s **ChatGPT Agent Builder** to stand up an attacker-controlled AI agent with a real employee's access and its approvals switched off," the AI security company stated in a two-part report shared with The Hacker News. ### How AgentForger Operated The attack mechanism was a classic case of cross-site request forgery (CSRF). An unsuspecting employee clicking a benign-looking **ChatGPT** link would unknowingly trigger the creation of a new AI agent within their company's trusted boundary, operating at the attacker's behest. **Agent Builder**, a visual, drag-and-drop canvas for creating multi-step agent workflows, was the target of this flaw. Although **OpenAI** announced its deprecation effective November 30, 2026, urging users to switch to the **Agents SDK**, the vulnerability existed within its framework. **Zenity**'s testing revealed that the **Builder** tool accepted an initialization state via URL parameters, including an agent template and a natural language prompt. **Mike Takahashi**, AI Red Team Researcher at **Zenity**, explained, "We found that when the page loads, the value of `initial_assistant_prompt` is not merely placed into the prompt box. It is automatically submitted and executed." This meant an instruction embedded within a URL could become the first command the **Builder** acted upon. Attackers could craft phishing links following a pattern like: `chatgpt[.]com/agents/studio/new?template_name=[template name]&initial_assistant_prompt=[malicious prompt]`.  ### Prerequisites for Exploitation For the attack to succeed, several conditions had to be met: * The victim needed to be logged into **ChatGPT**. * The victim must have had access to **Workspace Agents**. * The victim required at least one authorized connector (e.g., an existing **ChatGPT** integration with an enterprise application like **Outlook**, **Gmail**, **Google Calendar**, **Google Drive**, **Slack**, or **Teams**). The connector integration was crucial because the crafted **ChatGPT** URL would input a chief-of-staff template, enabling the agent to pull necessary data from workspace applications to prepare a "high-signal operating brief." ### The Malicious Payload and its Impact The malicious prompt embedded in the URL instructed the **Builder** to perform a sequence of actions: 1. Create an agent from the chief-of-staff template. 2. Attach all available connectors and configure them to "Never ask," bypassing user approval. 3. Publish the agent and schedule it to run hourly, establishing a persistence mechanism. 4. Invoke "Preview Mode" to run the agent immediately. 5. During each run, check for emails from a specific address with a subject line starting "TASK," execute those tasks, and report results back to the attacker's email address. **Zenity** clarified, "Preview Mode is meant to allow users to test an agent before publishing it. In this flow, however, Preview is not just a visual preview or dry run. It executes the newly created agent against the victim's connected accounts using the approval settings that have just been configured." This effectively turned the forged agent into a persistent operator. The initial click installed it, the schedule maintained its activity, and connected applications provided a source of commands, access to sensitive data, and a channel to exfiltrate results. ### Autonomous Insiders and Broader Compromise With this capability, the rogue workspace agent could burrow deeper into an organization. It could conduct reconnaissance, harvest sensitive documents from cloud storage services, and steal passwords from communication channels like **Slack**. Essentially, it transformed into a persistent, autonomous insider capable of executing the attacker's will. Furthermore, such an agent could impersonate the victim to send phishing links on **Teams**, redirecting recipients to fake **Microsoft** login pages to siphon credentials. This scenario posed a significant risk, potentially leading to broader compromise and various business email compromise (BEC) scenarios. **Takahashi** emphasized, "The attacker does not need the victim to click another link. They do not need the **Builder** tab to stay open. Once the agent is published and scheduled, the attacker can keep sending it assignments through the victim's mailbox. Each TASK email becomes a new assignment for the agent. The agent is not waiting for another click. It is waiting for instructions." "At its core, **AgentForger** is an agent trust failure: the platform trusts that the user intentionally created, approved, scheduled, and operated the agent." These findings follow **Zenity**'s earlier disclosures about threat actors exploiting critical **LiteLLM** vulnerabilities and exposed **Ollama** endpoints to hijack AI infrastructure. These campaigns involve the abuse of **CVE-2024-6587**, **CVE-2026-40217**, and **CVE-2026-35029**. **Zenity** concluded, "Self-hosted model servers and agent frameworks keep getting deployed while being misconfigured and unauthenticated, on predictable ports, willing to serve any client. This turns exposed AI infrastructure into convenient, deniable backend compute for offensive AI agents."