A vulnerability in ChatGPT Workspace Agents allowed attackers to create and deploy a malicious AI agent inside an organization from a single phishing link. The flaw, dubbed AgentForger, was corrected by OpenAI on 8 June 2026.
The attack exploited a permissive parameter in the Agent Builder that could receive instructions directly through the URL. When an authenticated user opened the prepared address, the command was sent and executed automatically without any additional confirmation step.
For the attack to succeed, the victim needed access to Workspace Agents and at least one pre-authorized enterprise connector. Supported connectors included Outlook, Gmail, Google Drive, Slack, Teams, and Google Calendar.
Attack Flow
- The malicious prompt instructed the platform to create a new agent.
- The agent connected to all available enterprise applications.
- Approval requests were disabled.
- The agent was published and scheduled for immediate and recurring execution.
In the proof-of-concept demonstration, the agent searched for emails sent by the attacker with subjects beginning with “TASK”. Each such message served as a new command, allowing the agent to perform tasks and return results to an address controlled by the attacker.
The vulnerability was reported on 4 June and resolved four days later by removing the vulnerable parameter. No evidence of real-world exploitation has been found. Organizations are advised to review published agents, connected applications, scheduled tasks, and any settings that bypass human approval.
