On July 23, security researchers at Zenity Labs published something that deserves a lot more attention than it's getting in non-security circles. They disclosed a vulnerability in ChatGPT Workspace Agents they named AgentForger. OpenAI already patched it. But the flaw is patched — the attack pattern it represents is not.
Here's the short version: an employee at a company using ChatGPT Enterprise or Teams clicks a normal-looking ChatGPT link. No password prompt. No OAuth consent screen. No warning. A rogue AI agent silently spins up inside their organization, inherits access to all their connected apps — email, Slack, cloud storage, Teams — and starts polling an attacker-controlled inbox every five minutes, waiting for instructions.
Traditional phishing steals one password. This deploys an AI operative.
What AgentForger actually did
The vulnerability was a CSRF-class flaw in ChatGPT's Workspace Agent Builder. When a ChatGPT Workspace link included a specific URL parameter — initial_assistant_prompt — the platform treated it as executable input rather than user-supplied content. No confirmation required.
An attacker crafts a URL, sends it to a target, and the moment that target opens it while logged in, a new AI agent is created and published inside their workspace. The whole thing happens invisibly, behind the normal ChatGPT interface the victim is already familiar with.
Once running, the forged agent inherited whatever connected-app permissions the victim had already authorized in their ChatGPT account. For most people in orgs that have gone all-in on ChatGPT Enterprise, that's a lot: email, calendar, Slack or Teams, Google Drive or SharePoint, maybe CRM access. All of it, wired to a polling loop that checked the attacker's inbox every five minutes for emails with "TASK" in the subject line.
Zenity demonstrated what that looks like in practice. In their proof of concept, the rogue agent:
- Searched Slack for any messages containing passwords
- Organized the results into a table
- Emailed the table back to the attacker's inbox
One click. No malware installed. No suspicious network traffic. Just an AI agent doing what AI agents do — answering tasks — except those tasks came from an attacker.
Why your security stack won't catch this
This is where it gets uncomfortable.
Traditional endpoint detection looks for malware signatures, unusual process spawning, and suspicious system calls. AgentForger installs nothing. There's no executable, no DLL injection, no suspicious outbound connection to a known bad IP. From an EDR perspective, nothing happened. From a SIEM perspective, nothing happened. The AI agent that's now sitting in your workspace and pulling down attacker tasks looks identical to any other AI agent your team created legitimately.
AI activity is legitimized by default in most orgs. When a Slack bot reads channels or your email client summarizes messages, nobody flags it. That invisibility is exactly what makes a rogue agent powerful.
The same blind spot applies to your employees. Security awareness training has spent a decade teaching people to recognize sketchy login pages and not to hand over their passwords. Nobody's training them to be suspicious of ChatGPT links. Why would they be? It's a link to a tool they use every day, on the vendor's own domain.
What this means for a 15-50 person org
If your team uses ChatGPT Teams or Enterprise, the specific AgentForger flaw is patched. OpenAI fixed the vulnerable URL parameter on June 8 after Zenity reported it June 4 — the patch was in before the public disclosure.
But the broader reality it exposes isn't patched, because it's not a single bug. It's an architectural pattern.
Every AI workspace tool that lets employees connect their accounts, build agents, and authorize those agents to access other apps has this attack surface. ChatGPT Workspace has it. Microsoft Copilot Studio has it. Any platform that lets someone with appropriate permissions wire an AI agent into your company's data systems has it.
For most small orgs, nobody has actually looked at:
- What agents are currently running in their ChatGPT workspace
- What apps those agents are authorized to access
- When each agent was created and by whom
- What those agents are actually doing
The reason is simple: until recently, the threat model for AI workspace tools was "what if someone uses AI in a way we didn't intend?" AgentForger changes that to "what if someone uses our AI infrastructure as an attack vector?" That's a different question, and most orgs haven't asked it yet.
Three things to do before next week
Audit your ChatGPT workspace agents today. If you're on ChatGPT Teams, go to chatgpt.com/admin, navigate to workspace settings, and pull the list of all deployed agents. You should know what each one does, who created it, and what it's connected to. If you find agents you don't recognize or that have broader access than their stated purpose requires, revoke them and investigate.
Look at what you've connected to ChatGPT. Under your connected apps settings, you'll see everything your workspace agents can access. For most orgs this list has grown organically as teams connected things for convenience. Run through it with the same lens you'd use for a departing employee's access: does each connection still need to exist, at the scope it has?
Update your phishing awareness to cover AI tools. Your team knows not to click login links in emails. They need the same reflex for AI tool links that seem off. "Hey, check out this ChatGPT workspace I set up for you" is the new "Here's a link to view your invoice." The attacker's payload isn't a fake login form — it's the legitimate AI platform itself. Train your team to treat unexpected AI workspace links the same way they'd treat unexpected password reset links.
The bigger shift
AgentForger is the first well-documented public case of a CSRF-class attack being adapted for AI agent infrastructure. But the class of attack Zenity calls "Cross-Site Agent Forgery" has obvious descendants. As more orgs wire more AI agents into more business systems, the value of deploying a persistent agent inside a company — instead of just stealing static credentials — keeps rising.
Static credentials are one-time hauls. A rogue AI agent is a renewable resource: it can keep pulling data, monitoring communications, and accepting new task assignments for as long as it runs undetected.
The fact that OpenAI patched AgentForger quickly is good. The fact that it existed at all tells you something about where AI security is right now: these platforms were built for productivity first. The threat model for what a hostile actor could do with AI agent infrastructure is still catching up.
For small orgs, the window to get ahead of this is now. Not because you're about to be targeted tomorrow, but because the teams that audit their AI agent permissions today are the ones who won't spend three weeks in incident response next year trying to figure out how their Slack got drained.
This is one of the things we look at in a sprint with a new client — what's connected, what has access, and what would actually happen if something went sideways. If that audit sounds useful, we're easy to reach.