{"id":1994,"date":"2026-07-24T13:29:09","date_gmt":"2026-07-24T13:29:09","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1994"},"modified":"2026-07-24T13:29:09","modified_gmt":"2026-07-24T13:29:09","slug":"chatgpt-agentforger-flaw-could-deploy-rogue-workspace-agents-via-a-phishing-link","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1994","title":{"rendered":"ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link"},"content":{"rendered":"
\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed a critical vulnerability in OpenAI’s ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence (AI) agent inside a victim’s organization.<\/p>\n

The vulnerability has been codenamed AgentForger<\/strong> by Zenity Labs. The issue has since been addressed by OpenAI as of June 8, 2026, following responsible disclosure.<\/p>\n

\u00abA single link could hijack OpenAI’s ChatGPT Agent Builder to stand up an attacker-controlled AI agent with a real employee’s access and its approvals switched off,\u00bb the AI security company said<\/a> in a two-part report shared with The Hacker News.<\/p>\n

The attack occurs when an unsuspecting employee clicks open a benign-looking ChatGPT link, causing it to spawn a new AI agent within the company’s trust boundary that does the attacker’s bidding. The issue is a case of cross-site request forgery (CSRF) that forges an attacker-controlled autonomous AI agent.<\/p>\n

Agent Builder<\/a> is a visual, drag-and-drop canvas that allows users to build multi-step agent workflows. Last month, OpenAI announced<\/a> that it’s deprecating the product effective November 30, 2026, urging users to switch to the Agents SDK.<\/p>\n

Zenity said its testing found the Builder tool to accept an initialization state through URL parameters, two of which include an agent template and the prompt to the Builder.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abWe found that when the page loads, the value of initial_assistant_prompt is not merely placed into the prompt box. It is automatically submitted and executed,\u00bb AI Red Team Researcher Mike Takahashi said. \u00abThat means an instruction embedded inside a URL can become the first command the Builder acts on.\u00bb<\/p>\n

<\/p>\n

Given that a prompt can be inserted directly into the URL, an attacker can send the URL to a target in the form of a phishing link that adheres to the following pattern: \u00abchatgpt[.]com\/agents\/studio\/new?template_name=[template name]&initial_assistant_prompt=[malicious prompt].\u00bb<\/p>\n

\"\"<\/a><\/div>\n

Should a logged-in user click on the link, ChatGPT opens the Builder in the victim’s authenticated session and automatically submits the prompt embedded in the URL without requiring any further interaction. The attacker, however, needs to meet the below prerequisites –<\/p>\n

    \n
  • A victim who is logged into ChatGPT<\/li>\n
  • The victim has access to Workspace Agents<\/li>\n
  • The victim has at least one authorized connector (i.e., an already existing ChatGPT integration to an enterprise app like Outlook, Gmail, Google Calendar, Google Drive, Slack, or Teams)<\/li>\n<\/ul>\n

    The connector integration is necessary because the crafted ChatGPT URL passes as input a chief-of-staff template that allows the agent to pull necessary data from the workspace applications to prepare a \u00abhigh-signal operating brief.\u00bb<\/p>\n