OpenAI fixes AgentForger flaw that forged AI insiders

OpenAI patched a critical vulnerability in ChatGPT Workspace Agents that security firm Zenity Labs named AgentForger. The flaw, a tailored cross-site request forgery, let attackers create hidden, remotely controlled agents by tricking a logged-in employee into clicking a crafted URL. Zenity reported the issue on June 4; OpenAI accepted the report within a day and issued a fix by June 8.

Zenity found the vulnerability in ChatGPT’s Agent Builder. Two parameters in an initialization URL could be set to control the agent template and supply the agent’s initial instructions. One parameter selected a powerful template called Chief of Staff; the second, initial_assistant_prompt, provided text that the Builder would automatically submit and execute. With both parameters set, the Builder could create a ready-to-run agent with preprogrammed behavior.

The exploit required the target to be logged into ChatGPT, have Workspace Agents enabled, and have at least one already-authorized connector such as Gmail or Outlook. Because the connector was already authorized, the attack did not trigger a new OAuth consent prompt. A victim who clicked the weaponized URL would cause the Builder to create the agent, set a schedule, turn off approval prompts, hide the agent and make it live without further interaction.

Zenity described a weaponized initial prompt that instructed the agent to treat incoming emails from [email protected] with subjects beginning “TASK” as remote commands. The agent would check the connected mailbox, execute each TASK email in order against connected apps, and return results to the attacker by email, including raw values where appropriate. Other instructions disabled safety checks and concealed the agent’s presence from administrators and users.

Once installed, the agent continued to run on its schedule, used connected apps for data and actions, and received commands by email. Zenity wrote that the original click installed the agent, the schedule kept it alive, and the connectors gave it access and a way to return results. Potential uses listed by Zenity include reconnaissance, data exfiltration, credential harvesting, internal phishing, business email compromise and impersonation inside the organization’s trust boundary.

Michael Bargury, co-founder and CTO at Zenity, wrote: “This isn’t a forged request, it’s a forged insider. With one click, an attacker gets a fully autonomous agent inside your company that has your people’s identity and access, with the guardrails off.” Zenity compared AgentForger to a traditional CSRF that creates a persistent, tool-equipped autonomous system rather than a single unintended browser action.

OpenAI confirmed it addressed the specific parameters Zenity identified and implemented broader security updates for ChatGPT accounts and agents after the disclosure. Zenity published two posts describing the vulnerability and the steps used to exploit it.

Zenity emphasized the attack depended on an over-permissive parameter combined with a powerful template and the narrow preconditions described above. If those conditions were not met, the exploit could not complete as outlined.