Summary
Zenity Labs has disclosed “AgentForger,” a critical cross-site request forgery vulnerability in OpenAI’s ChatGPT Workspace Agents that allowed a single manipulated link to silently create and deploy a fully autonomous AI agent within an organization’s ChatGPT environment. The flaw, discovered in early June 2026 and patched by OpenAI within four days of disclosure, exploited two URL parameters in ChatGPT’s Agent Builder to embed attacker-controlled instructions into what appeared to be a normal ChatGPT link.
When a targeted employee clicked the link, a rogue agent was instantiated under their identity — inheriting their access to connected enterprise applications including Outlook, Gmail, Slack, Google Drive, and SharePoint. The agent operated on a schedule, running reconnaissance, exfiltrating sensitive files (M&A documents, employee compensation data, database credentials), impersonating the victim across platforms, and could even initiate wire transfer requests or phishing attacks against other employees — all while appearing to be a legitimate workspace automation.
Zenity Labs describes AgentForger as an evolution of classic CSRF: instead of forging a request, attackers forge an insider. OpenAI patched the vulnerability by removing the exploited URL parameter. However, Zenity emphasizes that the broader problem — AI agents becoming persistent, identity-bearing insider threats — remains unsolved across the industry.
Source
Zenity Labs — AgentForger Research Blog
SecurityWeek — OpenAI Fixes ChatGPT Agent Flaw
The Hacker News — ChatGPT AgentForger Flaw
Commentary
AgentForger is exactly the kind of attack class that the security industry has been warning about since enterprise AI agent adoption exploded. Once you give an AI agent persistent access to enterprise SaaS — email, Slack, file storage, finance systems — you’ve created an attack surface that traditional security tooling isn’t designed to monitor. There’s no malware process to detect, no lateral movement traffic to flag; the agent looks exactly like a legitimate automation because it literally runs as the victim user.
The four-day patch turnaround from OpenAI is genuinely impressive. But the harder problem is industry-wide: every enterprise AI platform that connects agents to business applications and doesn’t enforce strict origin validation on agent creation is vulnerable to this class of attack. The research from Zenity should be required reading for anyone deploying ChatGPT Enterprise, Microsoft Copilot Studio, or any similar agentic framework. The forged insider threat isn’t theoretical anymore.