ChatGPT vulnerability let attackers deploy rogue AI agents with a single phishing link

ChatGPT Vulnerability Enables Silent Agent Deployment

Cybersecurity researchers at Zenity Labs have uncovered a critical ChatGPT vulnerability that could have transformed OpenAI's Workspace Agents into a vehicle for corporate espionage. Codenamed AgentForger, this flaw allowed attackers to deploy malicious AI agents inside victim organizations through nothing more than a phishing link 1

1

. OpenAI addressed the vulnerability on June 8, 2026, following responsible disclosure, but the discovery reveals how AI agent systems can become unexpected attack vectors 2

2

.

The attack mechanism exploited a cross-site request forgery (CSRF) weakness in the Agent Builder tool, which allowed users to create multi-step agent workflows through a visual interface. When an unsuspecting employee clicked a benign-looking ChatGPT link, it would spawn a new autonomous AI agent within the company's trust boundary, configured to execute the attacker's commands without triggering any security controls 1

1

.

How Rogue AI Agents Infiltrated Corporate Systems

The AgentForger vulnerability stemmed from how the Builder tool accepted initialization parameters through URL strings. AI Red Team Researcher Mike Takahashi discovered that the initial_assistant_prompt parameter wasn't merely displayed—it was automatically submitted and executed when the page loaded 1

1

. This meant malicious instructions embedded in a URL could become the first command the Builder acted upon, all within the victim's authenticated session.

Attackers could craft malicious URLs following this pattern: chatgpt[.]com/agents/studio/new?template_name=[template name]&initial_assistant_prompt=[malicious prompt]. For the attack to succeed, victims needed to be logged into ChatGPT with access to ChatGPT Workspace Agents and at least one authorized connector to enterprise applications like Outlook, Gmail, Google Calendar, Google Drive, Slack, or Teams 1

1

.

Malicious AI Agents Operated as Persistent Insiders

Once deployed, these rogue AI agents could execute a sophisticated sequence of actions. The malicious prompt instructed the Builder to create an agent from the chief-of-staff template, attach all available connectors, and critically, set every connector to "Never ask" to eliminate approval requirements 1

1

. The agent would then go live with an hourly schedule, creating a persistence mechanism that continued operating long after the initial click.

The forged agents monitored victim mailboxes for emails from specific addresses with subject lines beginning with "TASK," executing those assignments and reporting results back to attackers. Through Preview Mode—intended for testing before publication—the agent executed immediately against connected accounts using the configured approval settings 1

1

. This agent trust failure meant existing security controls couldn't detect the threat, according to Michael Bargury, co-founder and CTO of Zenity Labs 2

2

.

Escalation Potential and Business Impact

The capabilities of these malicious AI agents extended far beyond simple data theft. Armed with connector access, forged agents could conduct reconnaissance, exfiltrate sensitive data from cloud storage services, and harvest passwords mentioned in Slack messages 1

1

. More troubling still, these autonomous AI agents could impersonate victims to send phishing links through Teams, redirecting recipients to fake Microsoft login pages designed to capture credentials. This capability opened pathways to broader compromise and business email compromise (BEC) scenarios.

Zenity Labs emphasized that attackers didn't need victims to click additional links or keep the Builder tab open. Once published and scheduled, the agent persisted independently, with each TASK email becoming a new assignment 1

1

. The disruptive potential of these attacks arguably exceeds traditional phishing campaigns, as a single click could establish persistent, autonomous access to corporate systems 2

2

.

OpenAI Response and Industry Implications

OpenAI resolved the vulnerability by removing the risky URL parameter that enabled the attack. No evidence suggests the flaw was previously discovered or exploited by malicious actors 2

2

. Notably, OpenAI announced last month that it's deprecating the Agent Builder tool effective November 30, 2026, urging users to migrate to the Agents SDK 1

1

.

This disclosure highlights emerging security challenges as organizations integrate AI agents into their workflows. The vulnerability demonstrates how AI systems can introduce novel attack surfaces that traditional security controls weren't designed to monitor. As enterprises increasingly deploy AI agents with access to sensitive corporate resources, security teams must develop new strategies to validate agent behavior and detect unauthorized deployments before they can exfiltrate sensitive data or compromise additional systems.🟡 curiosity.