ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link

Cybersecurity researchers at Zenity Labs have disclosed a critical vulnerability in OpenAI’s ChatGPT Workspace Agents, codenamed AgentForger, that could allow a single phishing link to stealthily build, authorize, and deploy an autonomous AI agent inside a victim’s organization. The issue, a cross-site request forgery (CSRF) flaw, was addressed by OpenAI on June 8, 2026, following responsible disclosure.

The attack occurs when an unsuspecting employee clicks a benign-looking ChatGPT link, causing it to spawn a new AI agent within the company’s trust boundary that does the attacker’s bidding. The vulnerability lies in the Agent Builder tool, which accepts an initialization state through URL parameters, including an agent template and a prompt. The prompt is automatically submitted and executed upon page load, allowing an attacker to embed malicious instructions directly into a URL.

Prerequisites for exploitation include a victim logged into ChatGPT with access to Workspace Agents and at least one authorized connector to enterprise apps like Outlook, Gmail, Google Calendar, Google Drive, Slack, or Teams. The malicious prompt instructs the Builder to create an agent from a chief-of-staff template, attach all available connectors with approval settings disabled, make the agent live and schedule it to run every hour for persistence, and invoke Preview Mode to execute the agent immediately. The forged agent can then conduct reconnaissance, harvest sensitive documents, steal passwords, and impersonate the victim to send phishing links on Teams, leading to broader compromise and business email compromise (BEC) scenarios.

Zenity Labs also highlighted the abuse of CVE-2024-6587, CVE-2026-40217, and CVE-2026-35029 in related attacks against exposed AI infrastructure.