AgentForger: One Phishing Link Deploys a Rogue AI Agent Inside Your Org

A single phishing link. No malware download, no credential entry, no multi-step setup. Just a click, and an attacker-controlled AI agent materialises inside the victim’s organisation with access to email, calendar, cloud storage, Slack and Teams.

That’s what Zenity Labs demonstrated with AgentForger, a vulnerability in OpenAI’s ChatGPT Workspace Agents that the company quietly fixed on June 8, 2026. Zenity disclosed the research publicly on July 23. The technical write-up is methodical and worth reading in full; what follows is the operational summary.

The Vulnerability

ChatGPT’s Agent Builder lets users create custom AI agents configured to use specific tools and enterprise integrations. When building one, the interface populates from URL parameters. Zenity found that one of those parameters, initial_assistant_prompt, was not just used to pre-fill a text field. When the page loaded, it automatically submitted and executed the prompt as if the user had typed it and hit enter.

That’s the critical mistake. The system treated a URL-delivered string as a trusted user instruction.

Combine that with a second parameter, template_name, which defaulted to the ‘Chief of Staff’ template, and an attacker could send a link structured like:

chatgpt.com/agents/studio/new?template_name=chief_of_staff&initial_assistant_prompt=[malicious instructions]

The prompt inside that parameter instructed the Agent Builder to create an agent with all connector permission requirements set to ‘Never ask’, disabling the approval gates designed to make each app access explicit. In Zenity’s proof-of-concept, the resulting agent polled an attacker-controlled email inbox for new commands at five-minute intervals, providing persistent interactive control over the victim’s enterprise account.

The full capability list makes uncomfortable reading. The agent had inherited access to every enterprise application the victim had already connected to ChatGPT, including email, calendar, cloud storage, and collaboration tools. Zenity documented it reading emails, searching files, impersonating the victim in Slack messages, and harvesting stored credentials. None of those actions triggered user confirmation because the agent was built to suppress all prompts.

Why the Access Radius Matters

The thing about ChatGPT Workspace Agents that makes AgentForger alarming rather than just notable: the integrations.

Enterprise ChatGPT deployments are often deeply wired into company infrastructure, precisely because that’s the value proposition. You connect Outlook, SharePoint, Slack, Jira, and your cloud storage and the assistant can draft from context and search across systems. Employees authorise those connections once, and the assistant remembers. That’s the design.

AgentForger shows what happens when an attacker can deploy an agent inside that authorised context without the user knowing. The blast radius isn’t limited to ChatGPT. It’s the entire set of applications the employee trusted to the platform.

The agent also persisted. It wasn’t a one-off data grab on click. The five-minute polling loop meant the attacker retained interactive control for as long as the victim’s session remained active, or until someone noticed.

Timeline

Zenity reported the issue to OpenAI via Bugcrowd on June 4, 2026. It was triaged and accepted the following day. OpenAI resolved it by June 8. Zenity held disclosure until July 23 to allow time for the fix to propagate.

There is no evidence of in-the-wild exploitation. OpenAI has not published a public advisory or assigned a CVE. Given the disclosure gap between fix and publication, it’s reasonable to assume the fix is in place for current users.

What This Illustrates About Agent Security

AgentForger fits a pattern that’s become familiar: agentic AI systems inherit trust from their environment, and the mechanism for authorising that trust is often a one-time setup step rather than a per-action gate. When an attacker can create an agent inside that trusted context, they inherit everything the user inherited.

This is architecturally different from traditional account compromise. The forged agent doesn’t need the user’s password. It doesn’t need to steal a session token. It is operating as a legitimate agent inside a legitimate authenticated session. Detection is harder because the actions look like normal assistant usage. The agent reading emails and querying files is what the legitimate agent would do too.

Zenity has indicated this is Part 1 of their AgentForger research. The implication is that the URL parameter execution issue is one variant of a broader class of agent initialisation vulnerabilities. That’s worth watching.

For security teams managing enterprise ChatGPT deployments: the immediate action is auditing which enterprise connectors your users have authorised. That list is the blast radius of any future vulnerability in this class. Reducing unnecessary integrations reduces the risk, and understanding what’s connected is the prerequisite to any meaningful conversation about AI agent security posture.

References

• Zenity Labs — AgentForger, Part 1: ChatGPT Cross-Site Agent Forgery
• The Hacker News — ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
• SecurityWeek — OpenAI Fixes ChatGPT Agent Flaw That Could Let Attackers Forge an AI Insider
• The Register — One ChatGPT link could smuggle a rogue AI agent into your company
• Business Wire — Zenity Labs Uncovers AgentForger, a ChatGPT Vulnerability
• The Decoder — One tampered ChatGPT link could spawn a rogue AI agent that took orders from an attacker every five minutes