OpenAI Fixes ChatGPT Agent Flaw That Could Let Attackers Forge an AI Insider
OpenAI has patched a critical vulnerability, dubbed AgentForger, in its ChatGPT Workspace Agents, allowing attackers to create and deploy invisible, autonomous agents within a company’s environment. The flaw stems from a misconfigured parameter within the agent build process, enabling an attacker to trick a logged-in employee into initiating a powerful, remote-controlled agent. The vulnerability was discovered and reported by Zenity Labs, and OpenAI swiftly addressed it within a week.
OpenAI has fixed a critical vulnerability, AgentForger, in its ChatGPT Workspace Agents, allowing attackers to create and deploy invisible, autonomous agents within a company’s environment. The flaw stems from a misconfigured parameter within the agent build process, enabling an attacker to trick a logged-in employee into initiating a powerful, remote-controlled agent. Zenity Labs discovered and reported the vulnerability, and OpenAI swiftly addressed it within a week.
With a single successful phishing attack, an unsuspecting employee could be tricked into launching an invisible autonomous agent remotely controlled by the attacker. The vulnerability lies within ChatGPT’s Agent Builder, which allows an over permissive parameter. Researchers found that the official agent build process could be usurped from within an initialization URL using two particular parameters. One names the agent template to be used, while the other (initial_assistant_prompt) provides instructions to the Builder.
The first parameter, using the Chief of Staff template, builds a more powerful and flexible agent than other templates. The latter contains instructions that are automatically submitted and executed. More specifically, the ‘initial prompt’ can become the first command the Builder acts on.
With these two parameters embedded in the URL, the attacker can generate a powerful agent with prespecified instructions. One of the instructions exploiting this process is to automatically accept emails from the attacker as new instructions, allowing the attacker to control the agent remotely.
Instructions are delivered by emails with a subject starting with ‘TASK’, undertaken autonomously by the invisible agent, and the results emailed back to the attacker. The agent is designed to operate without triggering traditional CSRF protections, making it difficult to detect.
Zenity reported its findings to OpenAI. Within a day, OpenAI accepted the findings, and had fixed the vulnerability within three days. AgentForger was disclosed on June 4 and fixed on June 8.
Related: OpenAI Says Its AI Models Broke Loose and Hacked Hugging Face
Related: OpenAI Unveils GPT-5.6 Sol as Its Most Advanced Cybersecurity AI
Related: Why Cybersecurity Must Rethink Defense in the Age of Autonomous Agents
Related: OpenAI Rolls Out Advanced Security for ChatGPT Accounts