Full Report
Researchers say OpenAI flaw let phishing bait create an autonomous corporate mole armed with employee access
Analysis Summary
# Vulnerability: AgentForger - Malicious OpenAI Workspace Agent Creation
## CVE Details
- **CVE ID**: Not Assigned (Reported via Bugcrowd)
- **CVSS Score**: N/A (Estimated High severity due to unauthorized automated actions)
- **CWE**: CWE-352 (Cross-Site Request Forgery - CSRF / Indirect Prompt Injection)
## Affected Systems
- **Products**: OpenAI ChatGPT Enterprise / Team Workspaces
- **Versions**: Found and patched in June 2024
- **Configurations**: Workspaces where custom GPT/Agent creation is enabled and connected apps (e.g., Slack, Microsoft 365, Google Workspace) are authorized by administrators.
## Vulnerability Description
The "AgentForger" vulnerability involved a flaw in the ChatGPT agent builder interface. The builder accepted specific instructions via URL parameters in a standard ChatGPT link. When a logged-in user clicked a specially crafted link, the agent builder would process embedded instructions to silently create, configure, and publish a new AI agent.
The flaw allowed an attacker to bypass manual setup steps, effectively automating the creation of a "rogue" agent that inherited the victim’s permissions and access to integrated corporate data sources (Outlook, SharePoint, Slack, etc.) without further user intervention.
## Exploitation
- **Status**: PoC available (Developed by Zenity Labs); patched by vendor.
- **Complexity**: Low (Requires the victim to click a single link).
- **Attack Vector**: Network (Phishing/Social Engineering).
## Impact
- **Confidentiality**: High (Access to internal documents, emails, and chat logs).
- **Integrity**: High (Ability to send messages and emails as the victim).
- **Availability**: Low (Primary impact is data exfiltration and impersonation).
## Remediation
### Patches
- **OpenAI Update**: OpenAI addressed the issue on June 9, 2024, by removing the vulnerable URL parameters that allowed for automated agent configuration. No user action is required for the web-based fix.
### Workarounds
- **Agent Policy**: Administrators can restrict the creation of GPTs/Agents within the workspace to specific trusted users.
- **Action Approvals**: Ensure "Always allow" is not enabled for sensitive third-party API actions, requiring a manual click for each outbound data movement or message.
## Detection
- **Indicators of Compromise**:
- Unexpected new agents appearing in the "My GPTs" or Workspace gallery.
- Unusual API activity in connected apps (e.g., a surge in Outlook searches or SharePoint downloads by a user).
- Chat logs showing the agent receiving instructions via specific keywords (e.g., "TASK") in emails or messages.
- **Detection Methods and Tools**:
- Audit OpenAI workspace logs for agent creation events.
- Monitor for outgoing emails or messages to unknown external domains triggered by AI integrations.
## References
- **Zenity Labs Research**: hxxps[://]www[.]zenity[.]io/blog/agentforger-at-openai/
- **The Register Article**: hxxps[://]www[.]theregister[.]com/2024/07/23/openai_agentforger_vulnerability/
- **Vendor Support**: hxxps[://]help[.]openai[.]com/