What if, for example, one of your staff members clicks on an apparently safe link, only to have an autonomous AI agent start operating within your company with the same access privileges as the user without any authorization? It is just like something from a science fiction movie – yet it used to be true.
Security researchers at Zenity Labs uncovered a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed exactly that. They named it AgentForger, and it is the kind of flaw that keeps security teams up at night.
The good news? OpenAI patched it on June 8, 2026, after responsible disclosure. But the story behind it is worth understanding.
What Was the ChatGPT Workspace Agents Vulnerability?
Fundamentally, AgentForger was an XSS request forgery vulnerability. What it means in simple terms is that an attacker can fool the browser of a logged in user to perform certain actions without the consent of the user. In the case here, such an action is that of creation and deployment of an illegitimate AI agent.
ChatGPT Workspace Agents vulnerability was particularly dangerous since it needed so much from the victim, just one single click. That’s it. No need to enter credentials, approve permissions, or confirm anything. The link did all the heavy lifting.
Zenity's AI Red Team Researcher Mike Takahashi put it this way: "A single link could hijack OpenAI's ChatGPT Agent Builder to stand up an attacker-controlled AI agent with a real employee's access and its approvals switched off."
How Did the Attack Work?
To understand the ChatGPT Workspace Agents vulnerability, you need to know a bit about Agent Builder. It is a visual, drag-and-drop tool for building workflows of multi-step agents. This should be considered as the process of creating a fully-fledged automation tool which can be integrated with enterprise applications such as Outlook, Gmail, Slack and Teams.
The issue was that the Agent Builder received initialization parameters via the URL. Two of those parameters were particularly problematic: one for an agent template and another for a natural language prompt. When the page loaded, the prompt was not just placed in a text box, it was automatically submitted and executed.
How the ChatGPT Workspace Agents vulnerability might be exploited in the real world is outlined below:
The attacker would create a URL which would have the following structure:
"chatgpt[.]com/agents/studio/new?template_name=chief-of-staff&initial_assistant_prompt=[malicious instructions]"
Then, the URL would be sent to the target by email, Slack, or any other communication application. In case the victim has an account in ChatGPT and can use Workspace Agents, they would click the provided URL and the Agent Builder would appear in the authenticated session and submit the malicious prompt.
Why Was the ChatGPT Workspace Agents Vulnerability So Dangerous?
The severity of this ChatGPT Workspace Agents vulnerability came down to a few key factors.
First, the attacker only needed three conditions to succeed: the victim had to be logged into ChatGPT, they needed access to Workspace Agents, and they had to have at least one authorized connector already set up—something like an integration to Gmail or Slack. The last condition was almost guaranteed for enterprise users.
Second, the malicious prompt could do a lot. The researchers demonstrated a payload that did the following:
- Created an agent using the chief-of-staff template
- Attached all available connectors and set every one to "Never ask," effectively disabling approval requirements
- Made the agent live and scheduled it to run every hour
- Triggered Preview Mode to execute the agent immediately
Preview Mode was particularly concerning. It was meant to let users test agents before publishing them, but in this flow, it executed the newly created agent against the victim's connected accounts using the approval settings that had just been configured.
In other words, the ChatGPT Workspace Agents vulnerability allowed a test run to become a full deployment.
What Could the Forged Agent Actually Do?
Once the rogue agent was running, the possibilities were alarming. The researchers showed that the agent could check for emails from a specific address with subject lines starting with "TASK," execute those tasks, and report results back to the attacker.
But it went deeper than that. The ChatGPT Workspace Agents vulnerability could be used to turn the forged agent into a persistent, autonomous insider threat.
It could:
- Conduct reconnaissance across the organization
- Harvest sensitive documents from cloud storage
- Steal passwords mentioned in Slack messages
- Impersonate the victim to send phishing links on Teams
Think about that last one for a moment. The agent could then contact other employees by sending emails impersonating a known employee and requesting the other employees click on fake Microsoft login pages, thereby stealing their passwords.
The Scariest Part: It Kept Running
One of the most frightening things about the vulnerability of the ChatGPT Workspace Agents is that the Builder tab would not have to be kept open by the victim. Once the agent was published and scheduled, it was independent. It would keep running every hour, waiting for new instructions.
"The attacker does not need the victim to click another link," Takahashi explained. "They do not need the Builder tab to stay open. Once the agent is published and scheduled, the attacker can keep sending it assignments through the victim's mailbox. Each TASK email becomes a new assignment for the agent. The agent is not waiting for another click. It is waiting for instructions."
That persistence made the ChatGPT Workspace Agents vulnerability particularly insidious. It was not a one-and-done attack. It created a foothold that could be used indefinitely.
Response of OpenAI to ChatGPT Workspace Agents Vulnerability
It is essential to state that OpenAI was quite fast to respond to the ChatGPT Workspace Agents vulnerability issue. The patch was released on June 8, 2026, thus blocking any possibility of auto-running prompts using URL parameters.
Also, it should be pointed out that OpenAI had already stated that the Agent Builder would become obsolete as of November 30, 2026, and advised all users to switch to the Agents SDK. It means that the ChatGPT Workspace Agents vulnerability may have expedited the process.
The Bigger Picture: AI Infrastructure Is a Target
This ChatGPT Workspace Agents vulnerability is not an isolated incident. It is part of a broader trend where AI infrastructure is becoming a prime target for attackers.
Just last month, Zenity revealed how bad actors are exploiting critical vulnerabilities in LiteLLM and exposed Ollama endpoints to hijack AI infrastructure. These attacks take advantage of vulnerabilities such as CVE-2024-6587, CVE-2026-40217, and CVE-2026-35029 in order to transform self-hosted model servers into deniable backend compute for offensive operations.
The pattern is clear:
AI adoption is outpacing security. Organizations are deploying model servers and agent frameworks with misconfigurations and no authentication, often on predictable ports that are easy to find. This makes them convenient targets for attackers looking for cheap, deniable computing power.
Conclusion
The AgentForger vulnerability was a near miss, revealing a major flaw within ChatGPT's Workspace Agent authentication and authorization processes. One phishing link away from turning this business enterprise AI into a fully autonomous attacker.
Thankfully, OpenAI fixed the ChatGPT Workspace Agents vulnerability before it could be widely exploited. However, these very concerns that have been raised, i.e., the misconfiguration of AI systems, over-reliance on platform security, and increasing attack sophistication, are only here to stay.
With time, AI will continue to become part and parcel of the enterprise, and cybersecurity professionals must be ready for anything. The next vulnerability may not be patched in time. The best defense is understanding how these systems work, where they are vulnerable, and how to protect them before an attacker gets there first.
FAQ Section
What was the AgentForger vulnerability in ChatGPT Workspace Agents?
AgentForger was a cross-site request forgery flaw that allowed attackers to create and deploy rogue AI agents inside an organization through a single phishing link. The attacker only needed the user to click on the link. It was patched by OpenAI on June 8, 2026.
What was the method by which the ChatGPT Workspace Agents vulnerability was exploited?
The hackers generated a link with a malicious prompt and sent the same to the ChatGPT user that was logged in. The moment the user clicked the link, Agent Builder executed the prompt and created an agent using the victim’s privileges.
What could attackers do with this vulnerability?
The forged agent could conduct reconnaissance, harvest documents, steal passwords from Slack, send phishing messages on Teams, and execute tasks sent via email. It effectively became a persistent, autonomous insider threat.
Has OpenAI patched this vulnerability?
Yes. OpenAI patched this vulnerability of ChatGPT Workspace Agents on June 8, 2026, after responsible disclosure by Zenity Labs. Also, OpenAI deprecated the Agent Builder from November 30, 2026.
What measures could organizations take to guard against AI vulnerabilities?
It is important that organizations carefully examine their use of AI technologies and permissions, apply behavioral monitoring to detect any abnormalities on the part of the agent, and authenticate their AI infrastructure.
