Rogue AI Agents Can Be Smuggled Into Companies Via Malicious ChatGPT Links
Researchers discovered a flaw in OpenAI's ChatGPT workspace agents, dubbed 'AgentForger,' allowing attackers to remotely create and deploy malicious AI agents within a victim's workspace.
Security researchers have uncovered a critical vulnerability within OpenAI's ChatGPT workspace agents, dubbed "AgentForger," which could allow attackers to remotely inject rogue AI agents directly into a company's internal ChatGPT environment. The exploit, detailed by Zenity Labs, hinges on tricking users into clicking a specially crafted link, which then leverages the victim's existing app integrations and permissions to autonomously access corporate data, impersonate employees, and exfiltrate sensitive information.
The attack vector targets the agent builder feature within ChatGPT, a tool designed to create AI assistants capable of interacting with various business applications like Outlook, Teams, Slack, and Google Drive. Zenity Labs demonstrated that by embedding malicious instructions within a seemingly innocuous ChatGPT link, an attacker could manipulate the agent builder to create, configure, publish, and schedule a malicious agent within the victim's workspace. This process bypasses traditional security measures by exploiting the trust inherent in the platform's integration capabilities.
Once deployed, the rogue agent operates with the victim's credentials and permissions, effectively acting as an insider threat. The researchers showed that these agents could autonomously rummage through corporate data, send messages as the employee, and continue their malicious activities long after the initial phishing attempt. Unlike conventional attacks that require credential theft or network intrusion, AgentForger effectively "forges" an insider by using the victim's own authorized access.
"This isn't a forged request, it's a forged insider," explained Michael Bargury, co-founder and CTO of Zenity. "With one click, an attacker gets a fully autonomous agent inside your company that has your people’s identity and access, with the guardrails off. Attackers no longer have to break in to steal your data. They can forge an insider to go get it for them. This is an agent trust failure, and existing security controls were never built to see it."
Zenity's proof-of-concept scenarios illustrated the agent's potential for widespread damage. These included automatically mapping organizational structures by scanning communications and files, hunting for sensitive credentials like passwords and API keys within chat logs, and even launching convincing phishing campaigns through the victim's own communication channels, such as Microsoft Teams. The ability to impersonate employees and send malicious lures from a trusted internal account significantly increases the likelihood of success for subsequent attacks.
The vulnerability was reported to OpenAI through Bugcrowd on June 4th. OpenAI acknowledged the report the following day and, according to Zenity, deployed a fix within four days by removing the problematic URL parameter that enabled the attack. The company did not immediately respond to requests for comment from The Register. While the specific AgentForger exploit has been patched, the incident highlights a growing concern as AI agents evolve from passive tools to active participants in corporate workflows.
The implications of this vulnerability extend beyond a single platform. As AI agents become more integrated into business operations and gain broader access to sensitive data and systems, the attack surface shifts. Organizations must now consider the security implications of AI agent trust and the potential for these powerful tools to be weaponized, demanding new security paradigms that can detect and mitigate AI-driven threats operating within the trusted boundaries of enterprise applications.
This new report from SecurityWeek details the specific technical mechanism of the AgentForger vulnerability, explaining how attackers can leverage a crafted initialization URL with two parameters to create a powerful, autonomous agent. It further clarifies that the agent's creation and operation can be completely invisible to the victim organization, provided certain preconditions like a logged-in user with an existing connector are met. The article also notes that OpenAI patched the vulnerability within three days of being notified.