"AgentForger": One ChatGPT Link Deploys an Attacker-Controlled Agent Inside a Victim Organization

OpenAI's ChatGPT Workspace and Agent Builder

Zenity Labs disclosed that the Agent Builder accepted its initialization state directly from URL parameters, including `template_name` and `initial_assistant_prompt`. A single crafted link, opened once by an employee, silently built, authorized, and deployed a working agent inside that organization's trust boundary. The payload told the builder to create an agent from the chief-of-staff template, attach every connector the employee had already authorized, set each one to "Never ask" so approval prompts never appeared, make the agent live, schedule it to run on a recurring basis, and invoke preview mode to run it immediately. On each run the agent checked a mailbox for messages from a specific attacker address with "TASK" in the subject and carried out whatever it found. The forged agent inherited the employee's access to email, calendar, cloud storage, Slack, and Teams, and could exfiltrate data, harvest credentials and MFA tokens, and impersonate the employee long after the original link was forgotten. OpenAI fixed the issue on June 8, 2026 following responsible disclosure and is deprecating the product effective November 30, 2026; the research was published July 23, 2026

A CSRF-style flaw in an agent-provisioning surface. Agent creation, connector attachment, approval-prompt suppression, scheduling, and execution were all reachable through GET parameters in a single authenticated navigation, with no confirmation step separating "open a link" from "stand up an autonomous insider with my permissions"