Full Report
Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence (AI) agent inside a victim's organization. The vulnerability has been codenamed AgentForger by Zenity Labs. The issue has since been addressed by OpenAI as of June 8,
Analysis Summary
# Vulnerability: AgentForger - Cross-Site Request Forgery in ChatGPT Agent Builder
## CVE Details
- **CVE ID**: Not specified in the article (Codenamed **AgentForger**).
- **CVSS Score**: N/A (Described as "Critical").
- **CWE**: CWE-352 (Cross-Site Request Forgery).
## Affected Systems
- **Products**: OpenAI ChatGPT Workspace Agents (specifically the **Agent Builder** tool).
- **Versions**: All versions prior to the June 8, 2026 patch.
- **Configurations**:
- Victims must be logged into ChatGPT.
- Victims must have access to Workspace Agents.
- Victims must have at least one authorized connector (e.g., Outlook, Gmail, Slack, Teams).
## Vulnerability Description
The vulnerability is a Cross-Site Request Forgery (CSRF) flaw within the ChatGPT Agent Builder canvas. The tool was found to accept an initialization state via URL parameters (`template_name` and `initial_assistant_prompt`).
The technical root cause is that the value provided in the `initial_assistant_prompt` parameter is not just pre-loaded into the UI, but is automatically submitted and executed upon page load. This allows an attacker to craft a malicious URL that, when clicked by an authenticated user, forces the Builder to create, configure, and deploy a rogue AI agent without further user interaction.
## Exploitation
- **Status**: Disclosed by Zenity Labs; addressed by vendor. PoC demonstrated by researchers.
- **Complexity**: Low (Requires only a crafted URL and social engineering).
- **Attack Vector**: Network (delivered via Phishing Link).
## Impact
- **Confidentiality**: High (Allows unauthorized access to emails, documents, and messages via connectors).
- **Integrity**: High (Allows the agent to perform actions on behalf of the user, such as sending emails or modifying data).
- **Availability**: Low (Persistence mechanism ensures the rogue agent remains active).
## Remediation
### Patches
- **OpenAI Update**: Addressed as of **June 8, 2026**. Users should ensure they are using the latest version of the ChatGPT web interface and Workspace configurations.
- **Deprecation**: OpenAI has announced that the Agent Builder product is being deprecated effective **November 30, 2026**, in favor of the Agents SDK.
### Workarounds
- **Connector Review**: Audit and remove unnecessary third-party connectors (Outlook, Slack, etc.) within ChatGPT settings.
- **Security Awareness**: Avoid clicking unsolicited links that direct to `chatgpt[.]com/agents/studio/new`.
## Detection
- **Indicators of Compromise**:
- Presence of unknown or unrecognized AI agents in the ChatGPT Workspace.
- Agents configured with "Never ask" approval settings for enterprise connectors.
- Unusual automated activity in connected enterprise apps (e.g., emails sent to external addresses or bulk document access).
- **Detection Methods**: Review audit logs for agent creation events and monitor for scheduled agent executions that interact with sensitive SaaS data.
## References
- **Zenity Labs Report**: hxxps://labs[.]zenity[.]io/p/agentforger-part-1-chatgpt-cross-site-agent-forgery
- **OpenAI Agent Builder Documentation**: hxxps://developers[.]openai[.]com/api/docs/guides/agent-builder
- **The Hacker News Article**: hxxps://thehackernews[.]com/2026/07/chatgpt-agentforger-flaw-could-deploy.html