Researchers from Zenity Labs disclosed a CSRF-class vulnerability in the OpenAI ChatGPT Agent Builder tool, which received the codename AgentForger. According to the researchers, a single click on a specially crafted link made it possible to create, authorize, and launch an autonomous AI agent inside the victim’s corporate environment — without any additional interaction from the user. The vulnerability affected organizations using ChatGPT Workspace Agents with connected enterprise integrations (Outlook, Gmail, Slack, Teams, Google Drive). OpenAI reportedly remediated the issue on June 8, 2026 following responsible disclosure. No public security advisory from OpenAI could be found at the time of publication.
Attack mechanism: from URL parameter to autonomous operator
Agent Builder is a visual builder that allows the creation of multi-step workflows based on AI agents. OpenAI has announced that support for this product will end on November 30, 2026, recommending migration to the Agents SDK.
According to Zenity Labs, the root cause of the issue was that Agent Builder accepted its initialization state via URL parameters, including template_name and initial_assistant_prompt. The critical point: when the page loaded, the value of the initial_assistant_prompt parameter was not merely placed into an input field but was automatically submitted and executed. This turned any instruction embedded in the URL into the first command that the Builder executed immediately.
The attack vector looked as follows: the attacker crafted a phishing link of the form:
chatgpt[.]com/agents/studio/new?template_name=[template]&initial_assistant_prompt=[malicious prompt]
For successful exploitation, according to the researchers, three conditions had to be met:
- The victim is logged in to ChatGPT
- The victim has access to Workspace Agents
- At least one connector is linked to a corporate application (Outlook, Gmail, Google Calendar, Google Drive, Slack or Teams)
Exploitation chain and persistence mechanism
As reported in the second part of the research, the malicious prompt passed via the URL instructed the Builder to perform the following sequence of actions:
- Create an agent based on the “chief-of-staff” template
- Connect all available connectors and set each to “Never ask” mode, disabling confirmation prompts
- Publish the agent and configure a schedule to run every hour — creating a persistence mechanism
- On each run, check incoming emails from a specific address with a subject starting with “TASK”, execute the specified tasks, and send the results to the attacker’s address
- Activate Preview Mode for immediate execution
A crucial detail: Preview Mode, intended for testing the agent before publication, according to the researchers performed real actions with the victim’s connected accounts, using the newly configured approval settings. This was not a “dry run” — the agent obtained full access to corporate data.
Why this matters: a new class of threats for enterprise AI
AgentForger illustrates a fundamental issue that the researchers describe as an agent trust failure: the platform assumed that the user had intentionally created, approved, scheduled, and launched the agent. No verification of intent was performed.
After deployment, according to Zenity, the rogue agent could function as an autonomous insider: conducting reconnaissance inside the organization, extracting documents from cloud storage, and collecting sensitive data from corporate messengers. The attacker no longer needed any further interaction with the victim — each email with a “TASK” subject became a new assignment for the agent.
The highest risk falls on organizations that actively use ChatGPT Workspace Agents with multiple integrations to enterprise services. The more connectors are enabled, the broader the attack surface and the larger the volume of data available to a compromised agent.
Broader context: vulnerable AI infrastructure
The AgentForger research fits into a trend that Zenity Labs is observing in parallel: attackers are actively exploiting vulnerabilities in self-hosted AI infrastructure. In particular, abuse has been observed of vulnerabilities in LiteLLM — CVE-2024-6587, CVE-2026-40217 and CVE-2026-35029 — as well as exposed Ollama endpoints, used to take over AI infrastructure and conduct attacks against third parties. Misconfigured model servers without authentication, available on predictable ports, turn into convenient anonymous compute resources for offensive operations.
Practical recommendations
- Audit existing agents: review all deployed Workspace Agents in your organization — especially those created using the “chief-of-staff” template. Pay particular attention to agents with scheduled runs and disabled confirmations
- Connector review: revisit the list of authorized ChatGPT integrations with corporate applications. Disable unused connectors — each of them expands the potential attack surface
- Mail rule monitoring: track incoming emails with a “TASK” pattern in the subject line that are sent to employees using ChatGPT Workspace
- Migration planning: given the announced end of support for Agent Builder on November 30, 2026, start migrating to the Agents SDK, assessing the security model of the new tool
- Limiting automatic execution: at the organizational policy level, consider prohibiting automatic creation and publication of agents without explicit multi-step confirmation
AgentForger is a clear demonstration of how a classic web vulnerability (CSRF), combined with automatic prompt execution and an agent trust system, creates a qualitatively new attack vector. Organizations using ChatGPT Workspace Agents should immediately audit their deployed agents and connected integrations, and when planning a migration to the Agents SDK, should build in requirements for explicit verification of user intent when creating and authorizing AI agents.
