With a link, you can place fake employees in any company through ChatGPT's Agent Builder

Security researchers have discovered a way to turn a single click on a link into a much more dangerous way than a typical phishing attack: a fully autonomous AI agent that, with the identities and privileges of a real employee, runs quietly within the company, receiving instructions from external attackers every five minutes.

Discovery by Zenity Labs

Security company Zenity Labs has disclosed a vulnerability in OpenAI's ChatGPT Workspace Agents and named it AgentForger-a deliberate evolution of decades-old cross-site request forgery attacks. The vulnerability lies in ChatGPT's Agent Builder, a visualization tool used to build multi-step autonomous agent workflows. Zenity found that two URL parameters during the tool's initialization process could be manipulated: one parameter is used to select a proxy template, which by default references a powerful "Chief of Staff" template; and the other parameter, named initial_assistant_prompt, is used to pass natural language instructions to the builder, which are automatically submitted and executed when the page loads, without the need for user input or confirmation of anything.

By concatenating these two parameters, an attacker can build a single URL. When a logged in employee clicks on the link, a fully functional autonomous agent is quietly built, configured and launched in their ChatGPT Workspace-the agent is instructed to check the attacker's email inbox every five minutes for new instructions.

Why is it more dangerous than ordinary phishing links

Traditional cross-site request counterfeiting attacks induce a browser to submit an unauthorized request. AgentForger is completely different: it fakes a persistent, tooled, and autonomous system that can operate directly within the company's trust boundaries. Michael Bargury, co-founder and chief technology officer of Zenity, said bluntly: "This is no longer a forged request, it's a forged insider. With one click, an attacker can implant a fully autonomous agent within your company that has the identity and privileges of your employee and has all safeguards turned off."

This attack only requires the target employee to be logged in to ChatGPT, have Workspace Agents enabled, and have at least one pre-authorized enterprise connector (such as Outlook, Gmail, Slack, or SharePoint). Because the connector is pre-authorized, no new permission prompt will pop up to warn employees that an abnormal situation has occurred. Zenity researchers confirmed that the resulting malicious agents were able to map organizational internal structures, steal sensitive documents, collect credentials, and pose as victims in Slack, Teams and emails.

How fast is the repair speed

Zenity reported the vulnerability to OpenAI through the Bugcrowd program on June 4, 2026. OpenAI confirmed the report within 24 hours and released a fix on June 8-it took just four days from the initial report to the patch release-by completely removing the vulnerable URL parameter processor. Zenity said it found no evidence that the vulnerability was exploited before the fix went online. OpenAI also separately announced that it will completely abandon the original Agent Builder tool, effective November 30, 2026, and use its new Agents SDK and Workspace Agents interface.

Part of a broader model

AgentForger belongs to a growing category of what researchers call the "deadly trio": untrusted input, access to private data, and unmonitored data leak paths-all three of which together turn the usefulness of AI agents into a risk. This failure mode is structurally different from recently reported sandbox escape and reward hacking attacks, including Kimi K3 's sandbox breakthrough and a series of cutting-edge model limit failure events this summer. The latter type of event involves the model itself exceeding its expected boundaries, while AgentForger demonstrates how attackers can use the proxy platform's own convenience features-one-click settings, pre-authorized connectors-to counter organizations using the platform.

What should I pay attention to next

Security researchers view AgentForger as a preview of a broader range of vulnerability types rather than an isolated flaw: As more companies adopt agent-building tools with deep pre-authorized access to internal systems, the attack surface of such "fake insider" attacks will expand accordingly. As enterprises accelerate the adoption of autonomous agents in the second half of 2026, how the AI agent platform handles URL-based initialization and default privilege inheritance will become the focus of continued attention.