Source: SecurityWeek — 2026-07-23
Summary
Zenity Labs disclosed AgentForger, a vulnerability in ChatGPT's Workspace Agent Builder that let a single crafted link silently create, authorize, and deploy an attacker-controlled AI agent inside a victim's organization — no download, no install, one click. The forged agent inherited whatever enterprise access the victim had already granted ChatGPT: email, calendar, cloud storage, Slack, and Teams. Zenity reported the flaw to OpenAI via Bugcrowd on June 4, 2026; OpenAI triaged it within 24 hours and shipped a fix by June 8.
Key Takeaways
- Root cause was two combined design flaws: "Cross-Site Auto-Execution" (Agent Builder executed unvalidated URL parameters the moment the page loaded) and "Overpermissive Natural-Language Control" (a plain-language prompt embedded in the URL could rewrite security-sensitive settings like approval policies and execution schedules).
- The forged agent wasn't a one-time trick — it kept receiving fresh instructions from the attacker after the initial click, turning a single phishing link into a persistent, remotely-controlled insider.
- Across a dozen proof-of-concept scenarios, Zenity Labs showed the forged agent could map an org's internal environment, harvest files and credentials, impersonate the employee, and spin up further compromised agents via internal phishing.
- OpenAI's fix removed the vulnerable URL parameter handler entirely rather than trying to sanitize it — the whole "configure an agent via URL" capability was cut.
- This is the same failure class as classic web CSRF/open-redirect bugs, just relocated into an agent builder's permission model — a sign that agent platforms are inheriting decades-old web vulnerabilities in new clothing.
Reel Script
Hook (18s, ~40 words) A single link — no download, no password prompt — was enough to plant a fully authorized AI agent inside a company's ChatGPT workspace, one that could read their email and Slack. No malware. Just a URL.
Core Concept (65s, ~150 words) Here's the mechanism. ChatGPT's Agent Builder lets you spin up an agent and configure it — its instructions, its permissions, its schedule — all through settings you'd normally click through by hand. The bug, called AgentForger, is that Agent Builder would also accept that exact same configuration stuffed into a URL, and it would execute it automatically the instant the page loaded. Think of it like a web form that's supposed to require you to click "submit" — except someone found a way to pre-fill and auto-submit it just by getting you to open a link. Combine that with a second flaw — the builder trusting plain-language instructions to silently change approval policies — and an attacker could remotely author an agent, grant it your permissions, and keep puppeteering it after the click. The agent isn't hacked. It's forged, using your own already-granted access.
Hands-On (60s, ~140 words) Picture the flow: attacker crafts a ChatGPT URL with an embedded instruction block. Victim clicks it — maybe from a phishing email. Page loads, Agent Builder auto-executes the embedded config, and a new agent spins up under the victim's account, inheriting every connector they'd already authorized — email, calendar, Slack, cloud storage. That agent now sits there, silently checking back with the attacker for its next instruction, like a sleeper cell with a badge. Zenity's proof-of-concept had it map the org chart, pull sensitive files, impersonate the employee in Slack, and forge more agents the same way. OpenAI's fix wasn't a patch to the URL parser — they just deleted the parameter that let configuration travel through a URL at all. Sometimes the fix isn't "validate the input," it's "stop accepting input there."
Takeaway (25s, ~55 words) If your product lets natural language silently reconfigure permissions, you've built a CSRF vulnerability for the agent era — and most agent platforms shipping this fast haven't audited for it yet. If you're deploying agent builders at your company, ask your vendor this exact question today: can configuration ever be triggered by a URL alone?