AgentForger: How a Single Phishing Link Turned ChatGPT into an Autonomous Spy Inside a Company

Cybersecurity specialists at Zenity Labs have described a vulnerability they named AgentForger. It affected the Agent Builder tool in ChatGPT — a visual constructor for building multi-step scenarios for autonomous AI agents. In essence, a single click on an innocuous-looking link was enough to spawn, inside an organization's trusted perimeter, an agent acting on the attacker's behalf. OpenAI fixed the problem on June 8, 2026, following responsible disclosure.

How it worked

At the heart of the attack lies a classic cross-site request forgery (CSRF). As the researchers found, the Builder accepted an initial state through URL parameters, including the agent template and a starting prompt. Moreover, according to researcher Mike Takahashi, the value of initial_assistant_prompt was not merely inserted into an input field but automatically submitted and executed when the page loaded. In other words, an instruction embedded in the link became the constructor's very first command.

All the victim had to do was be logged in to ChatGPT, have access to Workspace agents, and have at least one connector wired up to corporate applications — Outlook, Gmail, Google Drive, Slack, Teams and the like. After the link was clicked, the Builder opened in the user's authenticated session and, without a single additional action, executed the malicious prompt.

A stealthy, resilient agent

The prepared payload instructed the system to create an agent from the “chief-of-staff” template, attach every available connector to it, and set each one to “Never ask” mode — so that the user's approval would no longer be required. The agent was made active and given a run schedule of once an hour, turning it into a persistence mechanism. On every run it looked for messages from a specific address with a subject line beginning with the word “TASK,” carried out the assigned tasks, and sent the results to the attacker's inbox.

A special role was played by Preview Mode. Intended as a safe way to test an agent before publishing it, here it did not confine itself to a “dry run”: the agent was executed immediately, with its already-configured privileges, against the victim's real connected accounts.

An autonomous insider with no pulse

As a result, the attacker gained a permanent operator inside the company. Such an agent could conduct reconnaissance, siphon documents out of cloud storage, harvest passwords from Slack messages, and also send phishing links in Teams on the victim's behalf, leading recipients to a fake Microsoft login page — a direct path to business email compromise (BEC).

Notably, a repeat click was no longer needed: each new message with the subject “TASK” became the agent's next assignment. “The agent isn't waiting for another click. It's waiting for instructions,” Takahashi sums up. According to Zenity, AgentForger stems from a breakdown of trust in the agent: the platform assumes that the user themselves knowingly created, approved and launched it.

A curious detail: OpenAI plans to retire Agent Builder itself as early as November 30, 2026, urging users to move to the Agents SDK.

Source: The Hacker News