ChatGPT – Rogue Workspace Agents

Overview

Researchers at Zenity Labs disclosed a critical vulnerability in OpenAI’s ChatGPT Workspace Agents that could have allowed attackers to deploy rogue AI agents inside organizations with nothing more than a phishing link. Codenamed AgentForger, the flaw was patched by OpenAI on June 8, 2026 after responsible disclosure.

How AgentForger Worked

The vulnerability was a case of cross‑site request forgery (CSRF) in the Agent Builder tool:

• Attackers crafted a malicious URL containing parameters like template_name and initial_assistant_prompt.
• When a logged‑in employee clicked the link, the Builder automatically executed the embedded prompt.
• This spawned a new attacker‑controlled agent inside the victim’s workspace, bypassing approval flows.

Prerequisites for exploitation:

• Victim logged into ChatGPT.
• Victim had access to Workspace Agents.
• At least one authorized connector (e.g., Outlook, Gmail, Google Drive, Slack, Teams).

Attack Flow

The malicious prompt instructed the Builder to:

1. Create an agent using the chief‑of‑staff template.
2. Attach all connectors and set them to “Never ask” (no approvals).
3. Make the agent live and schedule hourly runs for persistence.
4. Invoke Preview Mode to execute immediately.
5. Process TASK emails — read instructions from emails and send results back to the attacker.

This turned the forged agent into a persistent insider, capable of:

• Harvesting sensitive documents from cloud storage.
• Stealing passwords mentioned in Slack or Teams.
• Sending phishing links impersonating the victim.

Why It’s Dangerous

• No second click required — once published, the agent kept running autonomously.
• Persistent foothold — scheduled tasks ensured survival across sessions.
• BEC potential — rogue agents could impersonate employees to spread phishing links.
• Trust failure — the platform assumed the agent was intentionally created and approved.

Defensive Recommendations

Organizations should:

• Enable pre‑fetch verification — most agent frameworks ship with it off by default.
• Route dependencies through vetted catalogs instead of public registries.
• Monitor for rogue agents created without explicit approval.
• Audit connector permissions to ensure “Never ask” settings aren’t abused.
• Educate employees about phishing links disguised as trusted ChatGPT URLs.

Expert in the Cloud Insight

AgentForger is a wake‑up call for enterprise AI governance. It shows how a single click can silently deploy a rogue agent with full access to corporate systems. The lesson is clear: AI agents must be treated as privileged identities, with strict verification pipelines and monitoring to prevent trust failures.