What happened
A newly disclosed AI agent vulnerability shows just how fragile the trust between users and autonomous AI tools can be. Security researchers at Zenity Labs discovered a flaw in OpenAI's Workspace Agents that let a single manipulated ChatGPT link secretly spin up a fully autonomous AI agent acting under a victim's own identity. The agent, once created, checked in with the attacker's server every five minutes for new instructions, effectively becoming a remote-controlled insider threat running inside a legitimate account.
Zenity named the flaw "AgentForger" and describes it as an evolution of the classic cross-site request forgery (CSRF) attack. In a normal CSRF exploit, a victim clicks a bad link and unknowingly triggers one unwanted action, like changing a password or sending money. AgentForger went much further: instead of forging a single request, it forged an entire autonomous agent, complete with permissions, connected tools, and a recurring task schedule.
The attack relied on ChatGPT's Agent Builder, a feature introduced in 2025 and available at chatgpt.com/agents/studio/new. The builder accepts two URL parameters: template_name, which selects a starting template such as "chief-of-staff," and initial_assistant_prompt, which supplies instructions. Zenity found that the page didn't just pre-fill the prompt field with the value of initial_assistant_prompt, it automatically submitted and executed it. That meant an attacker could embed a full sequence of setup instructions directly into a URL and have the browser run them the moment a logged-in victim clicked the link.
Because the malicious agent reused the connectors the victim had already authorized, such as Outlook, Gmail, Slack, Google Drive, SharePoint, or Teams, no new OAuth consent screen ever appeared. There was nothing to tip the victim off. OpenAI patched the vulnerability within four days of disclosure, but the underlying pattern it exposed remains relevant across the AI agent industry.
Why it matters
This incident matters because it marks a shift in how attackers can exploit AI systems. Traditional web security tools are built to catch malicious requests, suspicious logins, or unusual API calls. They are not designed to flag an AI agent that behaves like a normal, authorized part of the platform while quietly taking orders from an outside party every few minutes.
Zenity's core argument is that autonomous agents operate under legitimate user identities, which makes them nearly invisible to existing monitoring. A compromised agent doesn't need to steal credentials or break authentication. It simply inherits everything the victim already has access to: email, files, chat channels, and calendars. That is a fundamentally different threat model than the phishing and malware attacks most security teams are equipped to detect.
The demo Zenity built showed an attacker embedding a numbered task list inside the URL prompt, which walked the Agent Builder through connecting every available non-MCP connector and adjusting the agent's behavior automatically. One click was enough to build and publish a working malicious agent, no further approval steps required. That is the part that should worry any company rolling out AI agents at scale: the very features that make agents convenient, one-click setup, persistent memory, and broad tool access, are the same features that make them dangerous when hijacked.
How to use it today
For teams already using ChatGPT Workspace Agents or similar tools, there are concrete steps to take right now. First, confirm the patch is applied. OpenAI fixed AgentForger within four days of disclosure, so any account running current ChatGPT infrastructure should no longer be exposed to this specific exploit. Still, treat any unfamiliar chatgpt.com link, especially one embedded in an email disguised as a productivity tip, with suspicion before clicking it while logged in.
Second, regularly audit which agents exist in your workspace and what connectors each one has access to. Autonomous agents can persist quietly in the background, so a periodic review of active agents, their schedules, and their permissions is now a basic hygiene task, not an optional one.
Third, apply the principle of least privilege to connector authorization. If an agent only needs read access to a calendar, don't grant it access to email and file storage as well. This limits the blast radius if an agent is ever hijacked through a future flaw of this kind.
For smaller teams and solo creators experimenting with AI automation without wanting to manage complex enterprise permissions, it can help to start with lightweight, purpose-built tools rather than broad general-purpose agents. Free AI tools like the ones available at [mykreatool.com](https://mykreatool.com) let you test specific automation ideas, such as content generation or quick data processing, without connecting an agent to your entire inbox and file system.
Who benefits
Understanding this vulnerability benefits several groups. IT and security teams gain a concrete example of how agent-based attacks differ from traditional exploits, which helps justify investment in agent-specific monitoring rather than relying solely on existing endpoint or network security tools.
Product and platform teams building on top of AI agent frameworks, whether OpenAI's, Google's, or Microsoft's, benefit from seeing exactly how a permissive URL parameter design decision, letting a prompt auto-submit without confirmation, can turn into a full account takeover vector. That is a design lesson applicable well beyond ChatGPT.
Business leaders and entrepreneurs who are adopting AI agents to automate marketing, sales, or operations tasks also benefit, since this case is a reminder that convenience features need matching security review before wide rollout. Finally, everyday users of AI chat platforms benefit simply from knowing that not every ChatGPT link is safe to click, even one that looks like it comes from a colleague or a trusted newsletter.
Risks
The biggest risk highlighted by AgentForger is scale. A single tampered link could compromise an employee's entire authorized toolset in one click, no malware download and no separate credential theft required. Because the rogue agent operated under the victim's own identity, its actions would appear in logs as normal, authorized activity, making detection difficult after the fact.
There is also a broader industry risk. Zenity frames AgentForger as one instance of a new attack class targeting agent-based AI systems generally, not just OpenAI's implementation. As more platforms ship agent builders with URL-based automation and template systems, similar flaws are likely to surface elsewhere unless vendors build in explicit confirmation steps before an agent is created, published, or granted access to connected tools.
Finally, there is a trust risk for businesses adopting AI agents. If autonomous agents can be silently created and controlled by outside parties, companies need updated incident response plans that specifically account for AI agent behavior, not just traditional account compromise scenarios.
Conclusion
AgentForger is a wake-up call about how AI agent vulnerabilities differ from classic web exploits: instead of forging one request, an attacker forged an entire autonomous identity with recurring access to a victim's tools. OpenAI closed the specific hole within four days, but the pattern it revealed, convenience features that skip confirmation steps, will keep showing up as agent platforms expand. Businesses adopting AI agents should audit permissions regularly, question unfamiliar automation links, and favor tools that limit access to only what a task actually requires.
Comments 0