AgentForger: When a Phishing Link Is Enough to Create a Persistent AI Insider

Introduction

On July 24, 2026, Zenity Labs researchers publicly disclosed a critical vulnerability – dubbed AgentForger – in the ChatGPT Workspace agent builder. The flaw allowed an attacker to forge a malicious AI agent and make it persistent inside the victim's organization with a single click on a phishing link. Once activated, the agent operated as an autonomous insider with access to email, cloud storage, and enterprise communication platforms. OpenAI fixed the issue on June 8, 2026, before the public disclosure, but the episode serves as a stark warning about the security risks of enterprise AI infrastructure.

Technical Analysis

AgentForger was a Cross‑Site Request Forgery (CSRF) vulnerability nested in the visual agent builder (Agent Builder). By using a malicious URL crafted as chatgpt[.]com/agents/studio/new?template_name=...&initial_assistant_prompt=..., an attacker could inject an arbitrary prompt into the victim's authenticated session and trigger the creation of the agent without any additional interaction.

The forged agent used the chief-of-staff template and hooked all connectors already authorized by the user (Microsoft Outlook, Gmail, Google Calendar, Google Drive, Slack, Teams). It also forced the approval settings to “Never ask”, removing any confirmation prompts. The agent immediately started running in Preview Mode and was scheduled to execute hourly. Among its first actions, it scanned the inbox for emails with the subject “TASK”, executed the commands found in the email body, and sent the results back to the attacker. This mechanism created a persistent, asynchronous command channel that remained active even when the browser was closed.

The Agent Builder is scheduled for deprecation by November 30, 2026, and OpenAI encourages migration to the Agents SDK and native Workspace Agents.

Impact

The impact is critical because a single click could initiate a fully automated attack chain:

• Data exfiltration: sensitive documents from Google Drive or other cloud storage.
• Credential theft: keys, tokens, or passwords found in Slack messages, emails, or shared files.
• Impersonation: the agent could send messages on Microsoft Teams in the victim's name, further propagating phishing links and triggering Business Email Compromise (BEC) and lateral movement.
• Persistent command: the attacker could issue new orders simply by sending an email with the subject “TASK” to the victim. The agent would execute the command and return the results, ensuring continuous, unmonitored access.

The agent operated with the legitimate user's permissions and blended in among workspace agents, making detection difficult.

Mitigation

OpenAI addressed the vulnerability on June 8, 2026. Anyone using ChatGPT Workspace Agents should ensure they are running the updated version. Until the Agent Builder is deprecated (November 30, 2026), it is advisable to apply the following countermeasures:

• Disable or restrict the Agent Builder if not strictly necessary; consider an early migration to the new agent APIs.
• Train users not to click suspicious links, even if they appear legitimate (the chatgpt.com domain was exploited in the campaign).
• Regular audits: review the agents configured in the workspace and verify that connector approval settings have not been forced to “Never ask”.
• Principle of least privilege: limit authorized enterprise connectors to only those that are indispensable.

This discovery fits into a broader pattern of attacks on self-hosted AI infrastructure. Zenity Labs had already observed active exploitation of vulnerabilities CVE-2024-6587, CVE-2026-40217, and CVE-2026-35029 on exposed, unauthenticated instances of LiteLLM and Ollama, confirming the trend of targeting AI endpoints as springboards for offensive operations against third parties.

FAQ

1. What exactly is AgentForger?
AgentForger is a CSRF vulnerability in the ChatGPT Workspace agent builder that allowed an attacker to create and persist a malicious AI agent inside the victim's corporate account with a single click on a phishing link. The agent could access emails, calendars, files, and chats, and be remotely controlled via simple emails with the subject “TASK”.

2. Is my organization still at risk?
If the ChatGPT Workspace platform has been updated after June 8, 2026, the flaw is closed. If the Agent Builder is still active, it is wise to check for unknown agents and, where possible, disable it until migration to the new tools recommended by OpenAI. Maintaining a high level of anti-phishing training is also recommended.

3. What operational lessons should we learn from this incident?
AgentForger demonstrates that the adoption of AI agents in the enterprise expands the attack surface. It is essential to apply to AI interfaces the same protections used for traditional web applications (anti-CSRF, input validation, explicit approval flows) and treat internal links with the same caution as external ones. Continuous visibility and control over active agents become a new pillar of enterprise security.