Zenity’s AgentForger Turns a ChatGPT Link Into a Forged AI Insider

A single clicked link was enough to create a fully authorized, attacker-controlled AI agent inside a victim’s ChatGPT account, according to research from AI security firm Zenity Labs. The flaw, which Zenity calls AgentForger, let an attacker skip every checkpoint in OpenAI’s Workspace Agent Builder and quietly stand up a live, fully permissioned agent running under the victim’s own identity. SecurityWeek reported OpenAI’s fix on July 23.

Zenity is not describing an isolated bug. It is describing what happens when cross-site request forgery, a security flaw class that predates most of today’s AI companies, gets pointed at a system that creates autonomous software with real permissions instead of just submitting a form. “This isn’t a forged request, it’s a forged insider,” Michael Bargury, Zenity’s co-founder and CTO, told SecurityWeek. “With one click, an attacker gets a fully autonomous agent inside your company that has your people’s identity and access, with the guardrails off.”

How a Workspace Agent Is Supposed to Get Built

OpenAI’s Workspace Agents can connect to Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams, take actions across those services, and run on a schedule. Building one is meant to be a deliberate, interactive process. According to Zenity’s technical writeup, a user normally opens the conversational agent builder, picks a starting template, describes what the agent should do, reviews the configuration the builder generates, connects whatever tools are required, decides which of the agent’s actions need human approval, tests it in Preview Mode, and only then publishes it live.

Each step is a checkpoint. The template sets how powerful the agent can be. The connected tools set what it can touch. The approval settings set whether it can act without asking first. Together, they are supposed to guarantee that a human made a series of conscious decisions before an autonomous agent with real access went live inside a company’s systems.

The Way In: Two Parameters, One Link

Zenity found that the entire builder flow could be preloaded and driven from the URL itself, with no interaction required beyond the victim clicking a link. According to SecurityWeek’s reporting on Zenity’s findings, two parameters embedded in that link did the work. One selects which agent template to use; Zenity’s proof of concept used the “Chief of Staff” template, which builds a more powerful and flexible agent than the builder’s other starting points. The other, called initial_assistant_prompt, feeds instructions straight into the builder that are automatically submitted and executed as the agent’s first command.

Zenity’s proof-of-concept instructions went further than just creating the agent. They also told the builder to hide the agent, disable the “always ask” setting that would otherwise force human approval before the agent acted, and publish it live, all automatically, all from the same link.

From a Forged Request to a Persistent Insider

A conventional CSRF attack forces a victim’s browser into a single unwanted action. AgentForger is different because the unwanted action is the creation of a standing, autonomous system: an agent with tools, a schedule, and access to whatever connectors the victim had already authorized. Zenity’s second writeup, titled “The Autonomous Insider,” describes what that agent could do once it was live.

The Workspace Agents builder lets its creator define both the agent’s system instructions and its scheduled tasks. Zenity used that capability to turn the victim’s own mailbox into a remote command channel. The scheduled task told the forged agent to watch for email from an attacker-controlled address, treat any message with a subject line starting with “TASK” as an instruction, carry it out using whatever connected apps the agent could reach, and email the results back to the same attacker address, on a five-minute polling loop that ran without any further action from the victim.

SecurityWeek’s reporting on Zenity’s findings describes a forged agent capable of exfiltrating sensitive data, harvesting credentials, impersonating the victim, and delivering internal phishing or staging business email compromise, all under an identity the company had already trusted. As Bargury put it in that same conversation with SecurityWeek, attackers no longer need to break in to steal data when they can forge an insider to go get it for them instead, since existing security controls were never built to see an attack shaped this way.

A Four-Day Fix

Zenity reported AgentForger to OpenAI on June 4. OpenAI accepted the finding within a day and shipped a fix four days later, on June 8, according to SecurityWeek. Zenity held its own technical writeups until July 23, the kind of gap security researchers commonly leave so a vendor’s fix has time to reach users broadly before exploit-level detail becomes public. The vulnerability is patched, and nobody using ChatGPT’s Workspace Agents today needs to take action because of AgentForger specifically.

What the four-day patch timeline does not resolve is the underlying design gap Zenity is pointing at: a builder flow that assumed every step required a human in the loop, until a URL proved otherwise.

Why This Is a New Class of Problem, Not Just a Bug

In comments to CSO Online, Bargury framed AgentForger as evidence that agentic AI needs a different security model than the one built for conventional software. “We’re moving into a world where software doesn’t just help people work. It works alongside them,” he said. “As AI agents become more capable, attackers will naturally look for ways to influence them, just as they’ve always looked for ways to influence people.”

Every permission the forged agent used in Zenity’s proof of concept was permission the victim had already granted to their own account and their own connected apps. Nothing about the attack required stealing a password or breaching a server. It required convincing a builder that a URL was a trusted source of configuration decisions.

Bargury’s practical guidance to CSO Online centers on triggers: the scheduled tasks, inbound emails, or other automated events that cause an agent to act without a human present. “Those triggers should be governed just as carefully as the agent itself,” he said, arguing that high-impact actions should require approval where appropriate, and that security teams need the ability to quickly disable an agent or its triggers the moment something looks wrong. For organizations building or buying agent platforms with the same builder-driven, tool-connected, schedulable shape as ChatGPT’s Workspace Agents, that is the checklist AgentForger leaves behind: know what triggers exist, know what each agent can already reach, and be able to kill both fast. As Bargury put it, the question is no longer just whether an agent has permission to do something, but whether what it is doing is the behavior its owner actually intended. “The organizations that answer both questions,” he said, “will be in the strongest position to adopt AI safely.”