AgentForger Flaw Let One Click Build a Rogue ChatGPT Agent Inside Companies

Security firm Zenity says a since-fixed flaw in ChatGPT's Agent Builder let a single phishing click create and publish an agent with an employee's access to email, storage and chat apps, a new kind of insider threat.

By The AI Enterprise Magazine TeamWeek of July 20, 20264 min readNews · Weekly briefing

Illustration of a shield intercepting a counterfeit AI agent inside a corporate network

Key takeaways

One click, one rogue agent. Zenity said a single overly permissive URL parameter let a phishing link create, connect and publish an agent in the victim's ChatGPT workspace.
Fixed fast. Zenity reported the flaw on June 4; OpenAI acknowledged it within a day and resolved it within four days, before the July 24 disclosure.
A forged insider. The agent inherited the employee's connected apps, so traditional user and endpoint monitoring would see legitimate activity.
Lock down agent creation. Inventory agents and owners, narrow connector scopes, alert on disabled approvals and monitor agent behavior.

A single click on a phishing link could have created, authorized and published an autonomous AI agent inside a company's ChatGPT workspace, with access to the victim's email, calendar, cloud storage, Slack and Teams, security firm Zenity said on July 24. OpenAI fixed the flaw, which Zenity calls AgentForger, before it was disclosed. But the finding shows how agent builders turn an ordinary phishing click into a persistent insider threat, and why security teams need controls built for agents rather than just users.

What is the AgentForger vulnerability?

Zenity Labs found the issue in Agent Builder, part of OpenAI's ChatGPT Workspace Agents, according to the company's disclosure distributed through Business Wire. The root cause was one overly permissive URL parameter. It allowed anyone to embed instructions in a link that looked like a normal ChatGPT link. When a logged-in employee clicked it, those instructions ran in the victim's own Agent Builder with no confirmation step.

From there, Zenity said, an attacker could have the tool build an agent, connect the victim's already-authorized enterprise apps, turn off approval prompts, publish the agent and schedule it to keep accepting instructions. The agent then carried the employee's permissions.

In proof-of-concept work across about a dozen scenarios, Zenity said the forged agent could exfiltrate data, harvest credentials and multifactor authentication tokens, impersonate the employee and launch internal phishing campaigns. Any organization using Workspace Agents with authorized enterprise connectors was exposed until the fix, the company said.

Did OpenAI fix it, and how fast?

Yes. Zenity reported the issue through OpenAI's Bugcrowd program on June 4. OpenAI acknowledged the report within a day and resolved it within four days by removing the URL parameter, according to Zenity. The disclosure did not give an exact fix date, and there is no indication in Zenity's account that the flaw was exploited in the wild.

The response time is a point in OpenAI's favor. The bigger issue is architectural, and it will outlast this specific bug.

Why does this matter for enterprise security teams?

Traditional security tooling watches users, devices and network traffic. AgentForger produced none of the usual warning signs: the agent was created by a legitimate user session, connected through approved integrations and acted with granted permissions. "This isn't a forged request, it's a forged insider," said Michael Bargury, Zenity's co-founder and CTO.

Three features of modern agent platforms combined to create the risk:

Inherited permissions. Agents act with whatever the creating employee can reach, across every connected app.
Self-service creation. No-code builders let anyone publish an agent, which also means a hijacked session can.
Persistence. A scheduled agent keeps running after the click, so the attacker does not need to keep access to the victim's account.

AI Connect speakers have warned about the first point for some time. "If your role can't see a column, neither can your agent," Snowflake's Sam Mittal, VP of AI Solutions, said in a AI Connect webinar on agent observability and early warning signals. That principle limits damage, but AgentForger shows its flip side: if the role can see everything, so can the agent.

What should companies using workplace AI agents do now?

Zenity's disclosure did not include a remediation checklist, and OpenAI's fix closes this specific path. Still, the case points to steps security and AI platform teams can take for any agent builder, from ChatGPT to Copilot Studio to in-house tools:

Inventory agents and their owners. Know which agents exist, who created them, when they were published and what they connect to.
Review connector scopes. Limit which enterprise apps can be attached to user-built agents, and prefer narrow, read-only scopes where possible.
Keep human approval on. Alert when approval prompts are disabled or schedules are added to an agent.
Monitor behavior, not just logins. Watch for agents that start sending email at scale, reading unusual folders or contacting new external addresses.

None of this is new as a principle. As Airia's Dave Horton put it in a AI Connect webinar on detecting shadow AI, "Shadow AI is nothing different from shadow IT," and the same layered detection applies. What is new is the speed: an agent that takes minutes to build can take minutes to forge. Earlier AI Connect panels on securing enterprise generative AI applications stressed role-based access and prompt injection defenses; AgentForger adds the agent creation workflow itself to the list of things to lock down.

Expect more research of this kind as agent builders spread across workplace suites. The question for CISOs is whether their monitoring can see an agent that was never supposed to exist.

Frequently asked questions

What is AgentForger?

AgentForger is the name Zenity Labs gave to a now-fixed flaw in ChatGPT Workspace Agents' Agent Builder that let a crafted link silently create and publish an attacker-controlled agent in a victim's workspace.

Has OpenAI fixed the AgentForger vulnerability?

Yes. According to Zenity, OpenAI resolved the issue within four days of the June 4 report by removing the overly permissive URL parameter, before public disclosure.