What exactly is the AgentForger vulnerability?

AgentForger is a cross-site request forgery flaw in ChatGPT's Agent Builder. The attack abuses two URL parameters: one selects the agent template, the other provides an initial_assistant_prompt that is automatically submitted and executed when the page loads. An attacker who tricks a victim into visiting a crafted ChatGPT URL can silently create a fully configured autonomous agent in the victim's ChatGPT workspace without any further interaction.

How did the rogue agent receive attacker commands?

The forged agent was configured to poll the victim's email inbox every five minutes, treating emails with subjects starting with TASK as commands. The agent executed those instructions autonomously, using whatever enterprise applications the victim had already authorised in their ChatGPT environment, then emailed results back to a attacker-controlled address. No persistent network connection back to attacker infrastructure was required.

Is this vulnerability still exploitable?

No. OpenAI patched the specific flaw on June 8, 2026, four days after Zenity Labs' disclosure on June 4. The fix addressed the permissive URL parameter handling in Agent Builder. No confirmed in-the-wild exploitation was identified before the patch. However, the attack class it demonstrates, cross-site agent forgery exploiting implicit permission inheritance, remains a structural concern across enterprise AI agent platforms that have not been specifically hardened against this pattern.

AgentForger: One Link Spawns an Attacker-Controlled AI Agent

A ChatGPT URL — the kind that arrives in a phishing email, gets pasted into Slack, or sits inside a routine file — was enough for an attacker to deploy an autonomous AI agent inside a target organisation, with no second click required. That’s the finding from Zenity Labs, published July 23, which named the vulnerability class AgentForger.

OpenAI has already fixed the specific flaw. The research matters because of what it demonstrated about how enterprise AI agent platforms handle trust boundaries.

The Mechanics

ChatGPT’s Agent Builder feature lets enterprise users create autonomous agents and connect them to external services: email, calendar, Slack, Teams, cloud storage. Zenity Labs found that the agent creation workflow could be fully driven from a URL.

Two parameters matter. The first selects the agent template to use. The second, initial_assistant_prompt, provides the instructions the new agent will operate under. The critical behaviour: when a page containing initial_assistant_prompt loads, the value isn’t just placed into a text box for the user to review. It’s automatically submitted and executed.

Combine that with the fact that ChatGPT’s Agent Builder didn’t validate the origin of these requests, and you have CSRF that creates not just a forged HTTP request but a complete, configured, running AI agent.

The forged agent inherited its creator’s authorised connections. Whatever services the victim had already connected to ChatGPT, the rogue agent had access to.

Email as C2

The command-and-control mechanism Zenity Labs demonstrated is worth noting. The rogue agent polled the victim’s inbox every five minutes for emails with subjects beginning with TASK. Those emails contained instructions. The agent executed them autonomously and sent results back to an attacker-controlled address.

This is unusual in a few ways. There’s no persistent connection to attacker infrastructure. The traffic looks like normal email activity from within the enterprise. The instructions are delivered through a channel the victim is expected to use. The agent’s own email access, previously authorised by the victim for legitimate ChatGPT use, becomes the C2 transport.

The attacker capability set: map the organisation’s internal structure, exfiltrate documents, harvest credentials from connected services, send emails or messages as the victim, conduct reconnaissance across whatever applications the victim had authorised. All of it executed by an AI agent acting with the victim’s identity.

Why the Permission Inheritance Model Is the Problem

The underlying issue isn’t just the CSRF bug. It’s that enterprise AI agent platforms are built around a permission inheritance model: agents act as the user who created them, using that user’s existing application authorisations.

That model makes sense for legitimate use, where the employee is in control and the agent is doing what they asked. It breaks down adversarially. A rogue agent inherits the blast radius of the creating user’s access. If that user had email, calendar, and Slack connected, the rogue agent has email, calendar, and Slack. No additional privilege escalation required.

The Zenity Labs disclosure makes this concrete. But the pattern isn’t specific to ChatGPT or even to CSRF as a delivery mechanism. Any pathway that creates an agent with a user’s identity without that user’s informed, intentional consent carries the same structural risk.

Disclosure Timeline

Zenity Labs disclosed to OpenAI on June 4, 2026. OpenAI patched on June 8, a four-day turnaround. The public disclosure, blog post and business wire announcement, came July 23. No in-the-wild exploitation was identified in the interim, though the window between disclosure and patch was narrow enough that this is difficult to confirm with certainty.

What This Looks Like Across the Platform Landscape

AgentForger is described as “Part 1” by Zenity Labs, which suggests more research is forthcoming. The same permission inheritance pattern applies to Microsoft 365 Copilot agents, Salesforce Agentforce, Google Workspace AI integrations, and any enterprise AI platform where agents operate with user-level credentials.

The CSRF vector is ChatGPT-specific and now patched. The agent forgery concept, creating an agent that operates with user permissions without the user’s awareness, is platform-agnostic. Different platforms implement agent creation and authorisation differently, which means different attack vectors for the same underlying class of exploit.

Security teams evaluating or running enterprise AI agent platforms should now have specific questions on their checklist: can agents be created without explicit user confirmation? Can a URL trigger agent creation? What audit log visibility exists for new agent creation events, and what access reviews cover existing agent authorisations?

AgentForger is, for AI agents, what open redirect vulnerabilities were for OAuth: not the deepest possible flaw, but one that demonstrates structural assumptions were never pressure-tested.