One Phishing Link Was All It Took to Plant an Invisible AI Agent Inside Your Company
Security researchers at Zenity Labs have disclosed a nasty vulnerability in OpenAI's ChatGPT Workspace Agents that, until last week, could allow an attacker to plant a fully autonomous, remotely controlled AI agent inside a target organisation using nothing more than a crafted URL and one unfortunate click.
They called it AgentForger. It's essentially a cross-site request forgery attack, but instead of making a victim's browser fire off a single rogue HTTP request, the payload is considerably worse: a living, breathing AI agent with tools, scheduled tasks, pre-approved connectors, and instructions to take orders from the attacker via email.
The flaw lived inside ChatGPT's Agent Builder. Zenity's researchers found that the agent initialisation URL accepted two parameters that should never have been this permissive. The first selects which agent template gets loaded, and choosing the Chief of Staff template conveniently produces a more capable agent than most alternatives. The second parameter, initial_assistant_prompt, injects instructions that are automatically submitted and executed during the build process, before the user has any chance to review what's happening.
Thread those two parameters together inside a malicious link and you've got a way to silently spin up a powerful agent with whatever instructions you fancy baking in. The attacker's instruction set, as demonstrated by Zenity, told the agent to monitor the victim's connected email account for messages with subjects beginning 'TASK', execute whatever those messages said using the connected apps, and report results back to the attacker. Raw. Unredacted.
Additional instructions hid the agent from plain view, disabled approval prompts so the build completes without asking the victim anything, and flipped the agent live. One click, done.
For this to work, the victim needs to be logged into ChatGPT, have access to Workspace Agents, and have at least one connector already authorised, Gmail and Outlook being the obvious candidates. That last point is important: because the connector authorisation already exists, no OAuth consent screen appears. Nothing pops up. The agent materialises silently inside the organisation's trust boundary, carrying the victim's identity and access rights.
From that point the attacker has a remote command-and-control channel disguised as ordinary email. Send a message with 'TASK' in the subject line, and the agent acts on it autonomously and reports back. Reconnaissance, credential harvesting, internal phishing, business email compromise, sensitive data exfiltration. The attacker never needs to touch the target environment directly again.
Zenity's CTO Michael Bargury put it plainly: 'This isn't a forged request, it's a forged insider. With one click, an attacker gets a fully autonomous agent inside your company that has your people's identity and access, with the guardrails off. Attackers no longer have to break in to steal your data. They can forge an insider to go get it for them.'
He's right, and it's a useful framing. Traditional CSRF is annoying. AgentForger is categorically different because the single unintended action creates an entire autonomous system that persists, schedules itself, and keeps working long after the victim has closed their browser tab.
Zenity reported the vulnerability to OpenAI on 4 June. OpenAI confirmed the findings within a day and shipped a fix by 8 June. Three days from disclosure to patch is genuinely fast, credit where it's due. Whether the underlying design assumptions that made this possible have been properly reconsidered is a different question.