ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
A critical vulnerability, dubbed AgentForger, in OpenAI's ChatGPT Workspace Agents allowed a single phishing link to deploy a rogue AI agent within a victim's organization. The vulnerability, discovered by Zenity Labs, exploited a cross-site request forgery (CSRF) flaw, enabling an attacker to build and schedule an autonomous agent with full access to connected accounts and data, including the ability to impersonate the victim and send phishing links. OpenAI has addressed the issue, but the discovery highlights broader security concerns around self-hosted AI infrastructure and the potential for malicious agents.
A critical vulnerability, dubbed AgentForger, in OpenAI's ChatGPT Workspace Agents has been disclosed, allowing a single phishing link to deploy a rogue AI agent within a victim's organization. The issue, discovered by Zenity Labs, stems from a cross-site request forgery (CSRF) flaw that bypasses user authentication and approval processes. This means an attacker could craft a malicious URL that, when clicked by a logged-in user, automatically spawns an AI agent with full access to connected accounts and data, including the ability to impersonate the victim and send phishing links on their behalf.
Specifically, the vulnerability leverages a drag-and-drop visual builder tool called Agent Builder. An attacker can embed instructions within a URL, which, when clicked by a logged-in user, automatically creates an agent from a pre-defined template and schedules it to run hourly. This newly created agent then continuously monitors connected accounts (like Outlook, Gmail, Slack, Teams, etc.) and executes tasks based on instructions received via email – specifically, emails with subjects beginning with the phrase "TASK."
The agent’s persistence is key: it doesn’t require further user interaction after deployment. It continuously monitors connected accounts and executes tasks, effectively becoming a persistent, autonomous operator within the organization. Furthermore, the agent can impersonate the victim to send phishing links on Teams, potentially leading to broader compromise and business email compromise (BEC) attacks.
OpenAI has since addressed the vulnerability, deprecating Agent Builder and urging users to migrate to the Agents SDK. However, the discovery underscores a wider security concern: the deployment of self-hosted AI model servers and agent frameworks without proper authentication and configuration can create vulnerable infrastructure that can be exploited by attackers to power their own offensive AI agents. The vulnerability highlights the risk of trusting a platform to validate user-supplied instructions, leading to a trust failure.
This incident follows Zenity Labs’ previous findings regarding vulnerabilities in LiteLLM and Ollama endpoints, demonstrating a trend of attackers leveraging exposed AI infrastructure for malicious purposes, utilizing CVE-2024-6587, CVE-2026-40217, and CVE-2026-35029.