One tampered ChatGPT link could spawn a rogue AI agent that took orders from an attacker every five minutes

A single tampered ChatGPT link could spin up an AI agent that quietly checked the attacker's inbox for new orders every five minutes. Zenity Labs calls the flaw a new class of attack against agent-based AI.

AI security firm Zenity Labs found a vulnerability in OpenAI's Workspace Agents that let one manipulated link create an autonomous AI agent under an employee's account. The agent took on the victim's identity and reused their existing app permissions, skipping the approval steps meant to protect sensitive actions.

Zenity named the vulnerability "AgentForger" and sees it as an evolution of classic cross-site request forgery (CSRF). In a typical CSRF attack, someone clicks a bad link or lands on a crafted page and unknowingly fires off an authenticated action they never intended.

AgentForger went further. Rather than triggering a single unwanted action, the manipulated ChatGPT link kicked off the creation of a fully autonomous agent. That agent operated inside the company's trust boundary, tapped into connectors the victim had already authorized, and picked up new tasks from the attacker on a recurring schedule.

Classic CSRF forges a single request. AgentForger forges an entire agent. | Image: Zenity Labs