Inside the AgentForger CSRF Vulnerability in ChatGPT Workspace

Security researchers at Zenity Labs recently disclosed a critical Cross-Site Request Forgery (CSRF) vulnerability in OpenAI’s ChatGPT Workspace Agents Builder, codenamed AgentForger. Patched by OpenAI on June 8, 2026, the vulnerability allowed an attacker to stand up a fully functional, rogue AI agent inside an enterprise organization through a single phishing link.

The flaw stemmed from how ChatGPT’s Agent Builder handled URL parameter initialization. When loading a crafted link containing the parameter initial_assistant_prompt, the platform did not merely fill in a text box—it automatically submitted and executed the prompt within the context of the user’s active session.

How Rogue AI Agents Grant Attackers Persistent Corporate Access

If a logged-in employee with Workspace Agent privileges clicked the link, the embedded command hijacked the agent creation process without requiring any visual confirmation or OAuth consent dialogs. The exploit sequence unfolded seamlessly in the background:

1. Agent Construction: The prompt built an agent using pre-existing chief-of-staff templates.

2. Permission Escalation: It automatically bound to existing enterprise integrations—such as Google Drive, Slack, Outlook, Gmail, and Microsoft Teams—and flipped approval toggles to “Never ask”.

3. Persistence Setup: It scheduled the agent to run every hour and activated “Preview Mode” to execute it instantly.

Once established, the forged agent operated as an autonomous inside agent. The attacker could maintain control without keeping the victim’s browser tab open. By sending emails to the victim’s inbox with subject lines starting with “TASK,” the agent would ingest the email, perform actions (such as searching internal Slack channels for passwords or harvesting cloud files), and exfiltrate the results back to the attacker. Furthermore, the rogue agent could impersonate the employee on internal Teams channels to send additional phishing links to co-workers.

🛡️ Our Perspective: Zero Trust for Enterprise AI Integrations

This vulnerability epitomizes the severe supply-chain and insider risks introduced by rapid enterprise AI adoption. AgentForger essentially turned a standard phishing click into a persistent, autonomous insider threat capable of bypassing traditional access controls. Our key takeaway is that AI agents cannot be implicitly trusted by default. As AI integrations burrow deeper into corporate workspaces, security teams must enforce strict identity validations for AI actions and apply Zero Trust principles to machine-to-machine interactions.