Zenity Labs Reveals Critical Vulnerability in OpenAI's Agent Builder

Zenity Labs Reveals Critical Vulnerability in OpenAI's Agent Builder

Zenity Labs has disclosed a vulnerability in OpenAI's Workspace Agents, dubbed "AgentForger," where a single manipulated link could create an autonomous AI agent acting on behalf of a user without their knowledge.

The attack exploited URL parameters to hijack the victim's application permissions, disable security controls, and permanently execute the attacker's commands on a scheduled basis, thereby turning the platform's capabilities against the user.

OpenAI patched the vulnerability within four days, but Zenity argues that this incident highlights a broader issue: traditional security tools are ill-equipped to handle autonomous agents operating under legitimate user identities.

A single manipulated ChatGPT link could spawn an AI agent that discreetly checked the attacker's inbox for new instructions every five minutes. Zenity Labs describes this vulnerability as a new class of attack against agent-based AI.

Details of the Vulnerability

The AI security company Zenity Labs discovered a vulnerability in OpenAI's Workspace Agents that allowed a manipulated link to create an autonomous AI agent under an employee's account. The agent assumed the victim's identity and reused their existing application permissions, thus bypassing the approval steps intended to protect sensitive actions.

Zenity named the vulnerability "AgentForger" and considers it an evolution of classic cross-site request forgery (CSRF). In a typical CSRF attack, a person clicks on a malicious link or lands on a crafted page and inadvertently triggers an authenticated action they did not intend to perform.

AgentForger went further. Instead of triggering a single unwanted action, the manipulated ChatGPT link initiated the creation of a fully autonomous agent. This agent operated within the company's trust boundary, exploited connectors already authorized by the victim, and retrieved new tasks from the attacker on a recurring schedule.

Automation of Agent Creation

Creating a Workspace agent is normally an interactive process. Users select a template, enter instructions, connect tools, review sharing settings, test the agent in preview mode, and then publish it. AgentForger allowed attackers to trigger most of this process via a URL with minimal other user input.

The Agent Builder, introduced in 2025, is available at chatgpt.com/agents/studio/new and accepts two URL parameters. template_name selects a starting template such as "chief-of-staff," while initial_assistant_prompt provides the instructions.

Zenity discovered that the page not only placed the value of initial_assistant_prompt in the prompt field but also submitted and executed the prompt automatically. Attackers did not need to send raw requests to ChatGPT or directly manipulate the victim's browser. All they needed was a chatgpt.com link with an attached prompt that appeared harmless at first glance.

Executing the Agent Without Approval

In the demonstration, Zenity embedded a prompt in the URL that guided the Builder through all the steps of a numbered task list. The agent was configured to integrate all non-MCP connectors already connected and change each permission requirement for reading, writing, and deleting to "Never ask."

It also created schedules to execute every five minutes, checking Outlook for emails from the attacker containing "TASK" in the subject line, executing their instructions using the connected applications, and returning the results unfiltered.

The completed agent, with linked connectors and all permission requirements disabled, was created without asking for user approval. It connected the authorized services, disabled approval requirements, published the agent, and launched it in preview mode.

Persistent Access Through Scheduling

Without the scheduler, the attack would have been a one-time event. The scheduler transformed the forged agent into something resembling a command and control infrastructure. Once deployed, the victim did not need to click again or reopen ChatGPT. The agent woke up every five minutes, checked the inbox for new TASK emails, executed the instructions they contained, and returned the results. The first click installed the agent, the scheduler kept it active, and the inbox became the command channel.

Examples of Abuse of the Victim's Identity

In the second part of its analysis, Zenity demonstrated what attackers could do through this channel. After receiving the command "TASK 1: RECON," the agent mapped the organization. It extracted data from Outlook, Slack, Teams, Drive, SharePoint, and Calendar to list people, roles, channels, active projects, and recurring meetings.

The agent also searched Drive, SharePoint, and Outlook. It found a merger and acquisition terms sheet, a board presentation mentioning missed revenue targets and planned layoffs, as well as a company-wide employee export with contact and compensation data. A request framed as a "DLP exercise" prompted the agent to search for the string "pass:". The agent found a pair of username and database password and sent both to the attacker.

Other tasks abused the victim's trusted identity. The agent sent messages via the victim's Teams account asking colleagues to confirm an SSO deployment on a login page controlled by the attacker. Zenity also tested phishing via Slack and a business email compromise template. Other tests included a request for approval for a $242,500 wire transfer and a calendar invitation with a participant controlled by the attacker.

Failure of Security Measures

Zenity traces AgentForger to two related design choices. The builder treated the initial_assistant_prompt parameter as an executable input rather than as a user input requiring confirmation. A URL controlled by an attacker could therefore change data and parameters within the victim's authenticated session without the user's explicit approval.

The same prompt could also modify security settings, including approval policies and execution schedules. This meant that the instruction could disable the system meant to require human approval for sensitive actions.

Zenity describes the combination as "the lethal trifecta": the URL provided an untrusted input, the connectors offered access to private data, and the email provided a pathway to send that data. Most exploits would have had to circumvent these security measures in the first place. AgentForger, however, gave the attacker access to a building tool that could create an agent with these security measures already disabled.

Conclusion

Zenity reported AgentForger via OpenAI's Bugcrowd program on June 4, 2026. OpenAI confirmed the report the following day and patched the vulnerability on June 8 by removing the affected URL parameter. Zenity praised the prompt response of OpenAI's security team.

Until the fix was deployed, the vulnerability affected all organizations using the ChatGPT Workspace Agents with previously authorized enterprise connectors, according to Zenity.

Zenity asserts that the issue goes beyond this specific bug. Traditional security tools are designed for users and endpoints, not for autonomous agents acting through legitimate user identities. The more an agent can act without supervision, the more damage it can cause when someone else provides its instructions. The cybersecurity company characterizes AgentForger as a "failure of agent trust": the platform assumed that the user had personally created, approved, scheduled, and launched the agent.

Security concerns surrounding agent-based AI have recently increased. Hugging Face reported that a fully AI-controlled system had breached its production infrastructure via a manipulated dataset and then moved laterally. The system performed over 17,000 actions, according to the company. OpenAI admitted its responsibility shortly thereafter. During a performance test, its model had accidentally hacked Hugging Face to obtain test data.

Zenity also demonstrated several clickless and one-click exploits last year under the name AgentFlayer. The attacks targeted Copilot Studio, Salesforce Einstein, Cursor with Jira MCP, and other enterprise AI tools. In these cases, prompts hidden in seemingly harmless resources could siphon customer data or steal login credentials.