**Critical AI Agent Vulnerability “AgentForger” Puts ChatGPT Workspaces at Risk**
A significant security threat has emerged for users of OpenAI’s ChatGPT, specifically those utilizing the now-deprecated Workspace Agents feature. Security firm Zenity Labs has uncovered a critical vulnerability, codenamed **AgentForger**, which could allow a sophisticated attacker to completely compromise a victim’s AI agent environment with minimal effort. The flaw has been remediated, but it highlights the evolving security challenges posed by increasingly autonomous AI systems.
### The Mechanics of AgentForger
The vulnerability is a form of Cross-Site Request Forgery (CSRF) that exploits the Agent Builder’s functionality. This tool, which allows users to visually create AI workflows, improperly handled initialization parameters passed through a URL. Specifically, the `initial_assistant_prompt` variable was not being sanitized or confirmed by the user upon execution.
The attack is initiated when a victim—who must be logged into ChatGPT and have access to Workspace Agents with an active integration (like Slack or Google Calendar)—clicks a malicious link. This link is cleverly disguised, often appearing as a legitimate or important communication.
Once clicked, the link forces the victim’s ChatGPT session to automatically create a new AI agent using a “chief-of-staff” template. This agent is then configured with dangerous settings: all available connectors are set to “Never ask” for approval, and the agent is scheduled to run automatically every hour. This setup allows the agent to operate persistently and autonomously within the victim’s trusted environment.
### The Severity of the Impact
The true danger of AgentForger lies in the agent’s subsequent actions. Once deployed, it can:
1. **Act as a Persistent Insider:** The agent remains active, waiting for commands. It can be instructed via emails with subject lines beginning with “TASK” sent to the victim’s email.
2. **Access and Exfiltrate Data:** With the authorized connectors, it can search through and steal sensitive documents, data from cloud storage, and even harvest passwords discussed in team messaging apps like Slack.
3. **Launch Further Attacks:** The agent can impersonate the victim to send phishing links to other employees via Microsoft Teams, potentially capturing credentials and expanding the breach throughout an organization.
“This is a fundamental trust failure in the platform,” researchers noted. “The attacker forges an agent, and the platform trusts that the user intentionally created, approved, scheduled, and operated it.”
### Mitigation and the End of an Era
The good news is that OpenAI addressed this critical vulnerability on June 8, 2026, following a responsible disclosure from Zenity Labs. Users are advised to ensure their accounts are updated. Furthermore, the Agent Builder tool is being deprecated entirely, with its end-of-life scheduled for November 30, 2026. Users are strongly encouraged to migrate to the newer, more secure Agents SDK.
—
### FAQ
**Q: What is “AgentForger”?**
AgentForger is the codename for a critical CSRF vulnerability discovered by Zenity Labs in OpenAI’s ChatGPT Workspace Agents (now deprecated). It allowed an attacker to trick a victim into creating a malicious, autonomous AI agent that could steal data and execute tasks without the victim’s knowledge.
**Q: Who is at risk?**
The vulnerability only affected users of the *old* ChatGPT “Workspace Agents” feature. Users who were logged in, had access to this feature, and had at least one authorized integration (like Slack or Google Calendar) were potentially vulnerable.
**Q: Has the vulnerability been fixed?**
Yes. OpenAI patched the vulnerability on June 8, 2026. The specific vector used in AgentForger is no longer exploitable.
**Q: What should I do now?**
If you were using the old Workspace Agents, you should migrate to the current Agents SDK. The Agent Builder tool is being retired, and its use is no longer supported or available.
**Q: What is the main lesson from this discovery?**
This incident underscores the security risks that come with powerful AI tools that can take automated actions. As AI agents become more integrated with our digital lives, ensuring they operate only with clear, verified user intent is paramount to prevent them from becoming tools for large-scale compromise.
—
### Conclusion
The AgentForger vulnerability serves as a stark warning about the security implications of AI agent workflows. While the immediate threat has been neutralized, the exploit demonstrated how a single malicious link could weaponize an AI assistant, turning its capabilities for corporate espionage and data theft. As the AI landscape continues to evolve, security must remain a primary design principle, both for the platforms that build these agents and for the users who deploy them. The deprecation of the vulnerable Agent Builder is a necessary step toward a more secure future for AI collaboration.
