One ChatGPT link could plant a rogue AI agent inside your company
OpenAI's ChatGPT agent builder had an AgentForger flaw letting a single link spawn a rogue AI agent with an employee's full access.
Security researchers at Zenity Labs disclosed a flaw they call 'AgentForger' in OpenAI's ChatGPT workspace agent builder. Clicking what looked like an ordinary ChatGPT link could silently create, configure, publish, and schedule an attacker-controlled agent inside a victim's ChatGPT workspace.
Rather than stealing credentials or sessions, the bug tricked ChatGPT's agent builder into wiring up an autonomous assistant that could act through the employee's existing connected apps and permissions. If the victim had linked services like Outlook, Teams, Slack, SharePoint, or Google Drive, and the organization allowed those actions, the rogue agent could rummage through corporate data, send messages impersonating the employee, and keep operating long after the original phishing email had done its job.
Instead of relying on traditional command-and-control infrastructure, the proof-of-concept agent simply checked the victim's inbox for emails with 'TASK' in the subject line to receive new instructions. Zenity reported the issue via Bugcrowd on June 4; OpenAI acknowledged it the next day and fixed it within four days by removing the URL parameter that enabled the attack.
The episode illustrates how, as AI agents move from answering questions to taking actions across corporate systems, the attack surface increasingly resembles the workforce itself rather than traditional software, raising new questions about agent trust and permission controls.