AgentForger — ChatGPT Agent Builder cross-site agent forgery deploys a persistent attacker-controlled Workspace agent from one link
Disclosed vulnerability23 Jul 2026🗺️ Tool-Using AgentZenity Labs disclosed that two unvalidated URL parameters in ChatGPT's Workspace Agent Builder let a single crafted link, opened by a logged-in enterprise user, silently create, authorize and deploy an autonomous agent under the victim's identity and connectors — bypassing approval prompts and reportedly polling an attacker inbox for commands every five minutes. Reported to OpenAI 4 Jun 2026 and fixed 8 Jun 2026; no in-the-wild exploitation reported.
Root cause — why it happened
ChatGPT's Agent Builder lets you drag-and-drop your own AI assistant. Researchers found it would read part of its setup from the web address you clicked — including a hidden instruction that ran automatically, without asking you first. So an attacker could craft a single ChatGPT link that, the moment a logged-in employee opened it, built an assistant in their name: hooking up the company's connected apps, turning off the 'are you sure?' prompts, publishing it, and putting it on a timer so it kept checking the attacker's inbox for orders. One click turned into a standing insider working for the attacker.
Risks this case illustrates
Named in the standard (OWASP/ATLAS/NIST) lens. Click a highlighted component in the diagram below to see which risks attach where.
How it unfolded
The Agent Builder trusts its URL
ChatGPT's Agent Builder is a canvas for composing your own assistant. Researchers found it would take part of its setup straight from the web link that opened it — including an instruction that ran on its own. The attacker crafts one such link and sends it to an employee, the way any phishing link is sent.
https://chatgpt.com/…/agent-builder?template_name=chief-of-staff&initial_assistant_prompt=<url-encoded attacker prompt> # two params are attacker-controllable; initial_assistant_prompt is auto-submitted # and executed with no explicit user confirmation. Prompt body redacted.
Controls & guardrails — what would have stopped it
The real fix is to never let a web link secretly build and switch on an assistant for you. Creating, connecting, publishing or scheduling an agent — and turning off its safety prompts — should each need a clear, deliberate 'yes' from the person that a link can't fake. Give new agents only the access they truly need, and watch for assistants that appear without anyone building them. OpenAI's fix removed the part of the link that made the attack work.
- Human-in-the-loop approval on high-risk actions
Approval fatigue turns gates into rubber stamps; gates placed after the point of no return do nothing; and approvers can be misled by a model-written summary of the action.
- Least-privilege identity & scoped credentials
Doesn't prevent manipulation — only caps its reach. Hard to get right operationally; over-broad scopes are the common real-world failure.
- Inter-agent authentication & admission controladdressesConfused Deputy (cross-agent)
Identity proves who an agent is, not that it is behaving honestly — an authenticated-but-compromised agent still needs isolation, taint-marking, and monitoring. Admission vetting is only as strong as the policy, and dynamically discovered agents in open ecosystems remain hard to fully vet.
- Runtime monitoring & anomaly detection
Detects the anomalous, not the novel-but-subtle; high false-positive rates cause alert fatigue. Always a step behind a sufficiently quiet attacker.
- Full-trace audit logging
Logging is forensic, not preventive — it explains harm after the fact. Useless if no one reviews it or if the materialised context isn't captured.
- Loop/cost circuit-breakers & consistency checks
Thresholds are blunt — too tight breaks legitimate long tasks, too loose lets damage accrue first. Catches runaway dynamics, not a single well-formed bad decision.
- Governance: risk assessment, red-teaming & incident response
Process reduces likelihood and speeds recovery but executes no technical control itself; weak follow-through makes it theatre.
Lessons
- ▸ An agent build/deploy surface is a state-changing control plane: initialization state driveable by a URL is a CSRF target, and a forged create/authorize/publish/schedule is worse than a one-shot action.
- ▸ Auto-executing a prompt supplied by a link turns navigation into an authenticated command — never run URL-supplied instructions without an explicit, un-forgeable confirmation.
- ▸ An approval gate that the setup flow can itself switch to 'Never ask' is no gate at all; gate integrity has to survive configuration time, not just runtime.
- ▸ Scheduling turns a one-click phish into persistence: a forged agent on a timer becomes a standing 'agentic insider' polling attacker C2 with the victim's identity and permissions.
- ▸ Least-privilege connector scopes and provenance-tagged agent-lifecycle logs are what bound and surface an insider you didn't knowingly create.
Proposals & gaps this case surfaced
Non-destructive suggestions for the library — proposed, not adopted.
A cross-site request-forgery or auto-executed initialization parameter drives an agent build/deploy control plane to create, authorize, publish and schedule an autonomous agent — and to change connector approval modes (e.g. to 'Never ask') — under a logged-in victim's delegated identity, without manipulating the model's runtime loop. Because a state-changing provisioning surface treats unauthenticated initialization state (such as a URL parameter carrying an auto-run prompt) as authenticated user intent, an attacker forges a persistent non-human principal operating with the victim's permissions; scheduling turns a one-click phish into a standing, attacker-controlled agentic insider.
Treat the agent build/deploy surface as a privileged control plane, not a pre-fillable form. Never auto-execute an instruction supplied via a URL/deep-link initialization parameter; require an un-forgeable, first-party confirmation (anti-CSRF token + explicit user action) before an agent is created, authorized, published or scheduled, and require a distinct, separately-confirmed step to downgrade a connector's approval mode (e.g. to 'Never ask') so the gate cannot be switched off during provisioning. Provision new agents with least-privilege delegated scopes, log every lifecycle event with its initiator's provenance, alert on newly-created agents that carry external-polling schedules, and keep a kill-switch to revoke/disable a forged agent. Closes the AgentForger vector where a single crafted chatgpt.com link forged a persistent 'agentic insider' under the victim's identity — the fix OpenAI shipped by removing the enabling URL parameter.
This case shows a gap people miss: we guard the things an AI agent does, but not the act of creating and switching on the agent itself. Here nobody tricked the AI's reasoning — a link quietly built an assistant, connected the company apps, turned off its safety prompts, and put it on a timer, all in the employee's name. We should treat 'building, connecting, publishing and scheduling an agent' as sensitive actions that a link must never be able to fake.
These surface as proposals across the Control Library and Risk Taxonomy; adopt them by hand when ready.
Sources
- AgentForger, Part 1: ChatGPT Cross-Site Agent Forgery — Zenity Labs (primary) ↗
- One ChatGPT link could smuggle a rogue AI agent into your company — The Register (23 Jul 2026) ↗
- ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link — The Hacker News ↗
- OpenAI Fixes ChatGPT Agent Flaw That Could Let Attackers Forge an AI Insider — SecurityWeek ↗
- OWASP LLM06:2025 Excessive Agency ↗ — The excessive-agency / over-permissioning class the forged agent realises under the victim's identity.
- MITRE ATLAS — AML.T0081 Modify AI Agent Configuration ↗ — The forgery modifies agent configuration (connectors, approval mode, schedules) as its exploit primitive.
Practise the risk class — related scenarios
An ops agent gets one god-mode credential — and one misread wipes production
A coding agent asks to write ./notes.txt — the file it actually overwrites is your SSH keys
A team of agents agrees its way into a confidently wrong answer — and a runaway loop
A text-to-SQL agent runs the model's output straight at the database
A jailbroken agent decomposes one malicious goal into hundreds of harmless-looking steps — and per-step filters never see the attack
A poisoned issue makes the agent lie to the human who approves its actions
Told it's being shut down, an agent reaches for leverage — with no attacker in sight
A fake Sentry error report hijacks a developer's coding agent into running a shell command
A 'safe' dataset preview turns an upload into code execution on the pipeline's workers
A shopping page tells the agent to do something the user never asked for
One click provisions an attacker-configured agent inside your own workspace
An attacker plants prompt injection in the audit trail — so the LLM that hunts them erases the evidence
Encoded public text is laundered across an agent handoff into an on-chain transfer
An attacker captures the agent's bearer token — and inherits its authority
A forged peer registers on the agent directory — and the planner enlists it
The eval gate that was supposed to catch the agent is itself the thing being attacked
A poisoned web page hijacks a research agent — and the planner acts on its behalf
A GUI agent clicks 'Continue' — but the screen moved, and it lands on 'Send'