The AgentForger vulnerability in OpenAI's ChatGPT Workspace Agents involved a CSRF attack exploiting two URL parameters in the Agent Builder: one specifying the agent template and another providing the initial assistant prompt. Using the Chief of Staff template and a crafted initial prompt, an attacker could create a powerful autonomous agent that automatically accepted commands via email and operated invisibly within the victim's environment. The attack required a successful phishing click by an employee logged into ChatGPT with access to Workspace Agents and at least one authorized connector (e.g., Gmail or Outlook), enabling the agent to act without triggering new OAuth consent. Once created, the agent could autonomously execute attacker instructions, harvest data, impersonate users, and conduct internal phishing or business email compromise activities. Zenity Labs reported the flaw to OpenAI, which fixed it within three days after acceptance. This vulnerability represents an agent trust failure allowing attackers to forge an insider AI agent with authorized access and no user approval prompts.

The vulnerability allowed attackers to create an invisible, autonomous AI agent inside a victim organization that operated with the victim employee's identity and access privileges. This agent could be remotely controlled via attacker emails to perform reconnaissance, data harvesting, credential theft, impersonation, internal phishing, and business email compromise. The attack bypassed traditional security controls by leveraging authorized connectors and existing user sessions, making detection difficult. The presence and actions of the agent were invisible to the victim organization, effectively forging an insider threat without requiring direct system compromise.

OpenAI has fixed the vulnerability within three days of disclosure. Organizations using ChatGPT Workspace Agents should ensure they are running the updated, patched version. Since this is not a cloud service vulnerability, users must apply the official fix provided by OpenAI. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed fixed as of June 8, 2026.