AgentForger: Cross-Site Agent Forgery in ChatGPT Workspace Agent Builder
AgentForger: Cross-Site Agent Forgery in ChatGPT Workspace (TL-2026-1713), also tracked as Cross-Site Agent Forgery, is a critical-severity software vulnerability, first published 2026-07-27. It has no confirmed attribution, affects OpenAI ChatGPT Agent Builder / ChatGPT Workspace Agents, maps to 19 MITRE ATT&CK techniques (T1041, T1053, T1071.003), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-1713
- Threat ID
- TL-2026-1713
- Also known as
- Cross-Site Agent Forgery, CSAF, Forged Insider, Planted Accomplice
- Severity
- CRITICAL
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-07-27
- Last reviewed
- 2026-07-27
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise, technology, corporateit
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in AgentForger: Cross-Site Agent Forgery in ChatGPT Workspace
Malware and tooling: ChatGPT Agent Builder, ChatGPT Workspace Agents, OpenAI Agents SDK
Zenity Labs disclosed 'AgentForger', a cross-site agent forgery flaw in OpenAI's ChatGPT Agent Builder in which two URL parameters — template_name and initial_assistant_prompt — auto-created and auto-executed a fully-privileged rogue agent the instant a logged-in victim clicked a crafted link. The forged agent inherited the victim's authorized connectors (Outlook, Gmail, Slack, Teams, Google Drive, SharePoint), flipped approval settings from 'Always ask' to 'Never ask', scheduled itself to poll the attacker's mailbox every five minutes for 'TASK' commands, and used those connectors for organizational reconnaissance, credential/MFA-token harvesting, data exfiltration, and employee impersonation. OpenAI patched the flaw by removing the vulnerable URL-parameter handler four days after Zenity's June 4, 2026 Bugcrowd report; no CVE was assigned and Zenity found no evidence of pre-patch in-the-wild exploitation.
How AgentForger: Cross-Site Agent Forgery in ChatGPT Workspace works
AgentForger is a logic/authorization flaw — not a memory-safety or injection bug in the traditional sense — in OpenAI's ChatGPT Agent Builder, the no-code interface used to create 'Workspace Agents' with access to enterprise connectors. Zenity Labs researcher Mike Takahashi found that the Builder's initialization endpoint, `https://chatgpt.com/agents/studio/new`, accepted state entirely from URL query parameters and executed it without any user confirmation or CSRF protection. The `template_name` parameter selected a pre-built agent template (notably `chief-of-staff`, a template pre-wired with broad tool access), and the `initial_assistant_prompt` parameter contained free-text instructions that were auto-submitted to the newly created agent the moment the page loaded.
Because the 'prompt' was just natural language, an attacker could use it to give the agent operator-level instructions rather than end-user requests: attach every connector the victim had already authorized in ChatGPT (email, calendar, cloud storage, Slack, Teams) with approval set to 'Never ask' for read/write/delete actions, publish the agent, invoke Preview Mode so it ran immediately, and schedule it to run every five minutes. Each scheduled run checked the victim's inbox for an email from the attacker whose subject line began with 'TASK'; if found, the agent read the instruction, executed it across whichever connected enterprise applications were needed, and emailed the results back to the attacker — an email-based command-and-control loop requiring no further interaction from the victim and no traditional malware on the endpoint.
Zenity characterizes the underlying design flaw as a 'lethal trifecta': untrusted input (the URL), access to private data (the victim's already-authorized connectors), and an unmonitored exfiltration path (outbound email/collaboration messaging) all converging in a single, invisibly-created agent. Zenity CTO Michael Bargury summarized the impact as producing 'a forged insider' rather than a forged request — the attacker obtains an autonomous, persistent operator running with a real employee's identity and access, capable of mapping the org chart, locating and exfiltrating sensitive documents (M&A materials, board decks, financial and HR records), harvesting passwords/API keys/MFA tokens surfaced in chat history, and impersonating the victim on Teams and email to stage further phishing and business-email-compromise fraud (Zenity's writeup includes a wire-transfer BEC example around $242,500).
Zenity reported AgentForger to OpenAI via Bugcrowd on June 4, 2026; OpenAI triaged and accepted it within roughly 24 hours and shipped a fix by June 8, 2026 by removing the vulnerable URL-parameter auto-execution handler. No CVE identifier was assigned. OpenAI is separately deprecating the Agent Builder product in favor of the Agents SDK, with a stated deprecation date of November 30, 2026. The novel TTP pattern here — URL-parameter-driven autonomous-agent creation, natural-language-based security-control tampering, and inbox-as-C2-channel — is broadly applicable to other agent-builder-style platforms and is included here as a detection-engineering reference case for agentic-AI authorization bypass even though the specific flaw is already patched.
MITRE ATT&CK techniques used in TL-2026-1713
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053 Scheduled Task/Job; T1078 Valid Accounts; T1098 Account Manipulation
Command and Control
Initial Access
T1078 Valid Accounts; T1566.002 Spearphishing Link
Privilege Escalation
T1078 Valid Accounts; T1548 Abuse Elevation Control Mechanism
Defense Evasion
Discovery
T1087 Account Discovery; T1526 Cloud Service Discovery
Collection
T1114 Email Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Execution
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
Resource Development
Impact
stealth
defense-impairment
Affected products and versions in AgentForger: Cross-Site Agent Forgery in ChatGPT Workspace
- OpenAI — ChatGPT Agent Builder / ChatGPT Workspace Agents
Vulnerable versions: Agent Builder prior to the 2026-06-08 fix
Fixed in: Agent Builder from 2026-06-08 onward (vulnerable initial_assistant_prompt/template_name auto-execution handler removed); product itself slated for deprecation 2026-11-30 in favor of the OpenAI Agents SDK
Remediation for AgentForger: Cross-Site Agent Forgery in ChatGPT Workspace
Patches
- OpenAI removed the vulnerable URL-parameter auto-execution handler in ChatGPT Agent Builder on 2026-06-08, four days after Zenity's Bugcrowd report; delivered as a platform-side fix with no CVE assigned
Immediate actions
- Confirm the tenant is on OpenAI's post-2026-06-08 ChatGPT Agent Builder build in which the vulnerable initial_assistant_prompt/template_name auto-execution handler was removed
- Audit all existing ChatGPT Workspace Agents for connectors configured with 'Never ask' approval and revert sensitive-action connectors (email send, file delete, wire/payment-adjacent actions) to 'Always ask'
- Review agent-creation and scheduling logs for agents created via crafted studio/new URLs, unexplained 5-minute/hourly schedules, or Preview Mode invocations the user does not recognize
- Revoke and re-authorize OAuth connector grants (Outlook, Gmail, Slack, Teams, Google Drive, SharePoint) tied to any agent that cannot be attributed to a legitimate user action
Workarounds
- Prior to confirming the fix, restrict access to ChatGPT Agent Builder / Workspace Agents for users whose accounts hold connectors to sensitive enterprise systems
- Monitor and quarantine inbound mail with 'TASK'-prefixed subject lines or other command-like patterns that could be used to drive a rogue scheduled agent
Longer-term hardening
- Migrate from the deprecated ChatGPT Agent Builder to OpenAI's Agents SDK ahead of the November 30, 2026 deprecation date
- Stand up AI-agent lifecycle governance: inventory every agent, its connectors, its approval posture, and its schedule across the environment
- Treat automation triggers (URL parameters, inbound email commands, schedules, webhooks) as first-class attack surface requiring the same monitoring as user accounts
- Require human approval for any high-impact connector action (sending mail/messages, deleting data, financial transactions) regardless of which template created the agent
Weaknesses (CWE) in AgentForger: Cross-Site Agent Forgery in ChatGPT Workspace
CWE-352, CWE-863, CWE-269
Timeline of AgentForger: Cross-Site Agent Forgery in ChatGPT Workspace
- Zenity Labs researcher Mike Takahashi reports the AgentForger cross-site agent forgery flaw to OpenAI via Bugcrowd
- OpenAI triages and accepts the AgentForger report within roughly 24 hours of submission
- OpenAI ships a fix removing the vulnerable initial_assistant_prompt/template_name auto-execution handler in ChatGPT Agent Builder, four days after the report; no CVE assigned
- Zenity co-founder and CTO Michael Bargury publicly characterizes the flaw as producing 'a forged insider' rather than a forged request
- Zenity Labs publishes 'AgentForger, Part 2: The Autonomous Insider', detailing the post-compromise email-based C2 loop and impersonation/exfiltration capabilities
- Zenity Labs publishes 'AgentForger, Part 1: ChatGPT Cross-Site Agent Forgery', detailing the URL-parameter exploit chain and the 'lethal trifecta' framing
- The Hacker News, SecurityWeek, CSO Online, OODAloop, MLQ, and The Decoder publish independent coverage of AgentForger
- Cyber Security News publishes a summary article on the AgentForger disclosure, the source feed item ingested by this pipeline
- OpenAI's stated deprecation date for the ChatGPT Agent Builder product, which it is retiring in favor of the Agents SDK
Sources cited for AgentForger: Cross-Site Agent Forgery in ChatGPT Workspace
- ChatGPT AgentForger Vulnerability
- AgentForger, Part 1: ChatGPT Cross-Site Agent Forgery
- AgentForger, Part 2: The Autonomous Insider
- ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
- OpenAI Fixes ChatGPT Agent Flaw That Could Let Attackers Forge an AI Insider
- AgentForger proves AI agents can become persistent insider threats
- Zenity Labs Uncovers AgentForger, a ChatGPT Vulnerability
- OpenAI Patches 'AgentForger' Flaw That Let Attackers Hijack Enterprise AI Agents via Single Link
- OpenAI Fixes ChatGPT Agent Flaw That Could Let Attackers Forge an AI Insider (OODAloop)
- One tampered ChatGPT link could spawn a rogue AI agent that took orders from an attacker every five minutes
Threats related to AgentForger: Cross-Site Agent Forgery in ChatGPT Workspace
Detection coverage for TL-2026-1713
As of 2026-07-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1713 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.