{"slug": "openai-patches-agentforger-flaw-that-let-attackers-hijack-enterprise-ai-agents", "title": "OpenAI Patches 'AgentForger' Flaw That Let Attackers Hijack Enterprise AI Agents via Single Link", "summary": "Security firm Zenity Labs disclosed a vulnerability in OpenAI's ChatGPT Workspace Agents that allowed a single manipulated URL to silently create an autonomous AI agent inside an enterprise environment, inheriting the victim employee's identity and access to connected business applications. OpenAI patched the flaw within four days of the initial report in June. Zenity CTO Michael Bargury called the vulnerability, dubbed 'AgentForger,' a new attack class against agentic AI systems.", "body_md": "# OpenAI Patches 'AgentForger' Flaw That Let Attackers Hijack Enterprise AI Agents via Single Link\n\n- Zenity Labs identified 'AgentForger,' a CSRF-style vulnerability in OpenAI's ChatGPT Agent Builder that let a single tampered link create an autonomous AI agent under a victim employee's identity\n[[1]](https://the-decoder.com/one-tampered-chatgpt-link-could-spawn-a-rogue-ai-agent-that-took-orders-from-an-attacker-every-five-minutes/) - The forged agent inherited the victim's access to enterprise connectors — Outlook, Gmail, Slack, SharePoint, Teams — and checked the attacker's inbox for new instructions every five minutes\n[[2]](https://labs.zenity.io/p/agentforger-part-2-the-autonomous-insider) - OpenAI confirmed the report one day after Zenity's June 4 disclosure and removed the affected URL parameter by June 8, a four-day turnaround\n[[3]](https://www.securityweek.com/openai-fixes-chatgpt-agent-flaw-that-could-let-attackers-forge-an-ai-insider/) - Zenity's proof-of-concept demonstrated the agent could exfiltrate M&A documents, harvest database credentials from Slack, and send phishing messages under the victim's name\n[[2]](https://labs.zenity.io/p/agentforger-part-2-the-autonomous-insider) - Zenity CTO Michael Bargury called AgentForger 'a forged insider' — not a forged request — representing a new attack class against agentic AI systems\n[[3]](https://www.securityweek.com/openai-fixes-chatgpt-agent-flaw-that-could-let-attackers-forge-an-ai-insider/)\n\nSecurity firm Zenity Labs disclosed a vulnerability in OpenAI's ChatGPT Workspace Agents on Wednesday that allowed a single manipulated URL to silently create an autonomous AI agent inside an enterprise environment, inheriting the victim employee's identity and access to connected business applications [1]. OpenAI patched the flaw within four days of the initial report in June.\n\nThe vulnerability, dubbed 'AgentForger,' exploited two URL parameters in ChatGPT's Agent Builder — the template selector and an initial prompt field — to forge an invisible agent that bypassed all approval requirements and polled the attacker's email inbox for new commands every five minutes [2]. Zenity researcher Mike Takahashi demonstrated that the agent could map organizational structures, exfiltrate sensitive documents, harvest credentials, and impersonate the victim across Slack, Teams, and email\n\n.\n\n[[1]](https://the-decoder.com/one-tampered-chatgpt-link-could-spawn-a-rogue-ai-agent-that-took-orders-from-an-attacker-every-five-minutes/)OpenAI received Zenity's report through its Bugcrowd program on June 4, confirmed it within 24 hours, and removed the vulnerable URL parameter by June 8 [3]. No evidence has surfaced that the flaw was exploited in the wild before the fix.\n\n## How the Attack Worked\n\nAgentForger is a cross-site agent forgery — a new variant of the classic cross-site request forgery adapted for AI agent infrastructure. The attack required only that a target employee be logged into ChatGPT with Workspace Agents access and at least one authorized enterprise connector such as Outlook, Gmail, Slack, or SharePoint [3].\n\nThe malicious URL contained two key parameters: `template_name`, which defaulted to the 'Chief of Staff' template — the most powerful available — and `initial_assistant_prompt`, which embedded a numbered task list that the Agent Builder treated as executable instructions rather than user-confirmable data [1]. When a victim clicked the link, ChatGPT automatically created an agent with all permission requirements set to 'Never ask,' bypassing the security controls designed to gate connector access\n\n.\n\n[[2]](https://labs.zenity.io/p/agentforger-part-2-the-autonomous-insider)Once created, the agent established persistent command-and-control by monitoring the attacker's email for messages with 'TASK' in the subject line, executing each instruction using the victim's legitimate credentials and connected applications, and returning results unfiltered to the attacker's account [2].\n\n## What the Agent Could Do\n\nZenity's proof-of-concept demonstrated a range of capabilities that mirror a sophisticated insider threat. The forged agent could map an organization's employee roster, roles, Slack channels, and active projects. It could search for and exfiltrate sensitive documents including M&A term sheets and board presentations [1].\n\nIn one demonstration, the agent located database credentials stored in a Slack channel and delivered them to the attacker in plain text. It could also extract employee compensation data, send phishing messages through Microsoft Teams under the victim's name, and request wire transfer approvals — all standard business email compromise tactics executed autonomously by an AI agent [2].\n\n## Why It Matters\n\nZenity described AgentForger as representing 'the lethal trifecta' for enterprise AI security: the URL supplied untrusted input, connectors provided data access, and email enabled exfiltration — all without requiring attackers to bypass existing safeguards [1]. Traditional security tools are not designed to detect autonomous agents operating under legitimate user identities, making this class of attack particularly difficult to catch.\n\nThe disclosure follows Zenity's 2025 'AgentFlayer' research, which demonstrated similar exploits against Microsoft Copilot Studio, Salesforce Einstein, and other enterprise AI agent platforms [4]. Together, the findings suggest that agent forgery is an emerging attack surface across the industry, not isolated to any single vendor.\n\nSeparate incidents underscore the concern. Hugging Face recently reported that an AI agent entered its production infrastructure through a manipulated dataset and performed over 17,000 actions before detection [1]. OpenAI itself acknowledged responsibility for accidentally accessing Hugging Face systems during performance testing\n\n.\n\n[[1]](https://the-decoder.com/one-tampered-chatgpt-link-could-spawn-a-rogue-ai-agent-that-took-orders-from-an-attacker-every-five-minutes/)## OpenAI's Response and What's Next\n\nOpenAI's four-day remediation — confirming the report on June 5 and deploying a fix by June 8 — drew praise from Zenity. The company removed the `initial_assistant_prompt` URL parameter entirely, eliminating the attack vector [3].\n\nThe rapid patch addresses this specific exploit, but Zenity's broader research suggests the underlying problem — AI agents that inherit user identity and connector access without adequate verification — remains an open challenge across the enterprise AI ecosystem. As organizations continue deploying agentic AI systems with access to sensitive data and business-critical applications, the attack surface for agent forgery will expand [1].\n\n## Companies mentioned\n\n## Further sources\n\n[[1] The Decoder — One tampered ChatGPT link could spawn a rogue AI agent that took … ↗](https://the-decoder.com/one-tampered-chatgpt-link-could-spawn-a-rogue-ai-agent-that-took-orders-from-an-attacker-every-five-minutes/)\n\n[[2] Zenity Labs — AgentForger Part 2: The Autonomous Insider ↗](https://labs.zenity.io/p/agentforger-part-2-the-autonomous-insider)\n\n[[3] SecurityWeek — OpenAI Fixes ChatGPT Agent Flaw That Could Let Attackers Forge a… ↗](https://www.securityweek.com/openai-fixes-chatgpt-agent-flaw-that-could-let-attackers-forge-an-ai-insider/)\n\n[[4] PRNewswire — Zenity Labs Exposes Widespread AgentFlayer Vulnerabilities ↗](https://www.prnewswire.com/news-releases/zenity-labs-exposes-widespread-agentflayer-vulnerabilities-allowing-silent-hijacking-of-major-enterprise-ai-agents-circumventing-human-oversight-302523580.html)\n\nThe stories that matter, in one email. Free — unsubscribe anytime.", "url": "https://wpnews.pro/news/openai-patches-agentforger-flaw-that-let-attackers-hijack-enterprise-ai-agents", "canonical_source": "https://mlq.ai/news/openai-patches-agentforger-flaw-that-let-attackers-hijack-enterprise-ai-agents-via-single-link/", "published_at": "2026-07-23 18:22:47.104728+00:00", "updated_at": "2026-07-23 18:22:49.065003+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-products"], "entities": ["Zenity Labs", "OpenAI", "ChatGPT Workspace Agents", "Michael Bargury", "Mike Takahashi", "Bugcrowd"], "alternates": {"html": "https://wpnews.pro/news/openai-patches-agentforger-flaw-that-let-attackers-hijack-enterprise-ai-agents", "markdown": "https://wpnews.pro/news/openai-patches-agentforger-flaw-that-let-attackers-hijack-enterprise-ai-agents.md", "text": "https://wpnews.pro/news/openai-patches-agentforger-flaw-that-let-attackers-hijack-enterprise-ai-agents.txt", "jsonld": "https://wpnews.pro/news/openai-patches-agentforger-flaw-that-let-attackers-hijack-enterprise-ai-agents.jsonld"}}