One Poisoned Link Planted a Self-Running Agent Inside a Company's ChatGPT

Zenity Labs disclosed research on Thursday describing what it calls AgentForger: a flaw in ChatGPT's Workspace Agents builder that turned a single link into a persistent, autonomous insider inside a victim's organization.

How it worked

The builder accepted template_name and initial_assistant_prompt as URL parameters — and auto-submitted them without asking the user to confirm. Clicking the link created, configured and published an agent under the victim's own authenticated session. Because it was the victim's session, the agent inherited every connector already authorized: Outlook, Gmail, Slack, SharePoint, Teams, Google Drive. Approval gates were switched off in the same payload.

The command channel

The planted agent then polled an attacker-controlled inbox every five minutes, looking for messages with "TASK" in the subject and executing what it found — twelve staggered schedules producing a five-minute loop. That is a standing command-and-control link running with a real employee's permissions; Zenity's demonstration used it to exercise a $242,500 wire transfer. CTO Michael Bargury: "With one click, an attacker gets a fully autonomous agent inside your company."

Timeline

Researcher Mike Takahashi reported it through Bugcrowd on June 4. It was triaged June 5 and fixed on June 8-9, when OpenAI removed the parameter. The vulnerability is closed; the disclosure is what is new.

Why the shape matters

This is cross-site request forgery reborn for the agent era. Classic CSRF tricks a browser into performing one action as the logged-in user. Here the forged action was creating a durable autonomous process that keeps acting long after the tab is closed — and agent builders that accept configuration from a URL turn every phishing link into a potential standing employee.