One tampered ChatGPT link could spawn a rogue AI agent

What happened

A single tampered ChatGPT link could spin up an AI agent that quietly checked the attacker's inbox for new orders every five minutes. Zenity Labs calls the flaw a new class of attack against agent-based AI. AI security firm Zenity Labs found a vulnerability in OpenAI's Workspace Agents that let one manipulated link create an autonomous AI agent under an employee's account.

Since every setting was already set to "Never ask," the first run finished without asking the user for approval. Without the scheduler, the attack would have been a one-time event. The scheduler transforms the forged agent into something that resembles command-and-control infrastructure. Once the agent is deployed, the victim doesn't need to click again or reopen ChatGPT.

The agent wakes up every five minutes, checks the inbox for new TASK emails, executes the instructions they contain, and sends the results back. The initial click installs the agent, the scheduler keeps it alive, and the inbox becomes the command channel. In part two of its analysis, Zenity shows what attackers could do through this channel. After receiving the command "TASK 1: RECON," the agent mapped the organization.

It pulled data from Outlook, Slack, Teams, Drive, SharePoint, and Calendar to list people, roles, channels, active projects, and recurring meetings. The agent also searched Drive, SharePoint, and Outlook. It found an M&A term sheet, a board presentation that mentioned missed revenue targets and planned layoffs, and a company-wide employee export with contact and compensation data.

A request framed as a "DLP exercise" told the agent to search Slack for the string "pass:". The agent found a database username and password pair and emailed both to the attacker. Other tasks abused the victim's trusted identity. The agent sent messages through the victim's Teams account asking colleagues to confirm an SSO rollout on a login page controlled by the attacker.

Why it matters

The agent took on the victim's identity and reused their existing app permissions, skipping the approval steps meant to protect sensitive actions. Zenity named the vulnerability "AgentForger" and sees it as an evolution of classic cross-site request forgery (CSRF). In a typical CSRF attack, someone clicks a bad link or lands on a crafted page and unknowingly fires off an authenticated action they never intended. AgentForger went further.

Rather than triggering a single unwanted action, the manipulated ChatGPT link kicked off the creation of a fully autonomous agent. That agent operated inside the company's trust boundary, tapped into connectors the victim had already authorized, and picked up new tasks from the attacker on a recurring schedule. Creating a Workspace agent is normally an interactive process.

Users select a template, enter instructions, connect tools, review sharing settings, test the agent in preview mode, and then publish it. AgentForger let attackers trigger most of that process through a URL with little further input from the user. com/agents/studio/new and accepts two URL parameters. template_name selects a starting template such as "chief-of-staff," while initial_assistant_prompt supplies the instructions.

Zenity found that the page didn't just place the value of initial_assistant_prompt in the prompt field. It also submitted and ran the prompt automatically. Attackers didn't need to send raw requests to ChatGPT or directly manipulate the victim's browser. com link with an attached prompt that looked harmless at first glance.

The only prerequisite was that the victim was logged into ChatGPT, had access to Workspace Agents, and had authorized at least one connector such as Outlook, Gmail, Slack, Google Drive, SharePoint, or Teams. Because the connections already existed, no new OAuth consent prompt appeared that might have tipped the victim off.

In the demo, Zenity embedded a prompt in the URL that guided the Builder through all the steps in a numbered task list. " It also created schedules to run every five minutes, checked Outlook for emails from the attacker with "TASK" in the subject line, executed their instructions using the connected apps, and sent the results back unfiltered.

The Builder created an agent named "TASK Mail Operator" without asking the user. It connected the authorized services, disabled approval requirements, published the agent, and launched it in Preview Mode. Zenity says Preview Mode isn't just a visual test run: It executes the new agent against the victim's real connected accounts using the approval settings that were just configured.

What to watch

Zenity also tested phishing through Slack and a business email compromise template. Other tests included an approval request for a $242,500 wire transfer and a calendar invitation with a participant controlled by the attacker. Zenity traces AgentForger to two related design choices. The builder treated the initial_assistant_prompt parameter as executable input rather than user input that needed confirmation.

An attacker-controlled URL could therefore change data and settings within the victim's authenticated session without the user's explicit approval. The same prompt could also change security settings, including approval policies and execution schedules.