OpenAI patched a vulnerability in its Workspace Agents platform four days after Zenity Labs disclosed a technique called AgentForger that allowed attackers to silently create fully autonomous AI agents inside a victim’s enterprise environment through a single phishing link. The issue is resolved. The attack pattern is relevant to any team building agentic platforms with user-facing agent builders.
How AgentForger Worked
OpenAI’s Workspace Agents let users build autonomous agents through a conversational interface, connecting them to Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams. The normal creation flow includes multiple checkpoints: choosing a template, providing instructions, configuring tool permissions, reviewing approval settings, and publishing.
Zenity Labs researcher Mike Takahashi found that the Builder accepted initialization state through URL parameters, and that the initial_assistant_prompt parameter was automatically submitted and executed when the page loaded. No additional user interaction was required beyond clicking the link.
A crafted URL could instruct the Builder to create an agent, attach all previously authorized connectors, switch approval settings to “Never ask” (disabling the gate meant to prevent agents from silently taking sensitive actions), publish the agent live, and install recurring schedules for execution every five minutes. The attack required only that the victim was logged into ChatGPT, had Workspace Agents access, and had previously connected at least one integration. Because those connections already existed, no OAuth consent screen was triggered, according to CSO Online.
Persistence Through Scheduling
The agent’s scheduled runs turned the attack from a one-time execution into a command-and-control channel. Once published, the forged agent woke on its schedule, checked the victim’s Outlook inbox for emails from attacker-controlled addresses with the subject “TASK,” carried out whatever instructions those emails contained using the victim’s connected services, and sent results back to the attacker, as Takahashi detailed.
The victim did not need to click another link, keep a browser tab open, or visit ChatGPT again. The original click installed the agent. The schedule kept it alive. The connected apps provided access to sensitive data and a path for exfiltration.
Reconnaissance, Credential Theft, and Impersonation
Once active, the forged agent could scan Outlook, Slack, Teams, Google Drive, SharePoint, and calendar data to map an organization’s structure, identifying people, roles, active projects, and internal discussions. According to CSO Online, Zenity’s demonstrations showed the agent searching for financial documents, business agreements, and invoices. It could also harvest credentials by scanning messages for passwords, one-time codes, access tokens, and API keys, and impersonate the victim by sending legitimate-looking Teams messages directing users to fake login pages.
“AgentForger showed that an attacker could deploy an autonomous insider agent inside your ChatGPT workspace with a single click,” Michael Bargury, co-founder and CTO of Zenity, told CSO Online.
The Architectural Lesson
The root cause combined two vulnerabilities: the Builder treated URL-embedded prompts as executable input without CSRF protection, and the approval toggle that controlled whether agents could take sensitive actions autonomously was itself controllable through the same prompt.
For teams building agent platforms with user-facing builders, AgentForger illustrates a specific risk: any agent creation interface that accepts initialization parameters from untrusted sources and can modify its own permission boundaries through those same parameters creates an exploitable surface. The fix is straightforward. CSRF protection on builder endpoints, separation between prompt input and permission configuration, and mandatory user confirmation before publishing agents with elevated privileges.
“We’re moving into a world where software doesn’t just help people work. It works alongside them,” Bargury told CSO Online. “As AI agents become more capable, attackers will naturally look for ways to influence them, just as they’ve always looked for ways to influence people.”