Zenity Labs identified and responsibly disclosed a severe security flaw in OpenAI’s ChatGPT Workspace Agents, dubbed “AgentForger.” The vulnerability hinges on a crafted CSRF attack that leverages two URL parameters—template and initial_assistant_prompt—to hijack the Agent Builder process.

When the attacker supplies a “Chief of Staff” template together with a malicious initial prompt, the system builds a high‑privilege agent that automatically accepts further instructions sent via email. Because the attack uses an already‑authorized connector (e.g., Gmail, Outlook), no new OAuth consent screen appears, keeping the operation invisible to the victim.

The malicious URL also disables the “always ask” safeguard and enables the “Make this agent live” flag, allowing the agent to run continuously without user interaction. Once active, the attacker can issue commands by emailing subjects that start with “TASK,” receive raw data back, and even conduct internal phishing or business‑email compromise (BEC) campaigns.

Historical Background: Traditional CSRF attacks cause a single unintended browser action. AgentForger expands this concept by creating an entire autonomous system—complete with tools, schedules, and pre‑approved connectors—effectively forging an insider without ever breaching the network perimeter.

Why This Matters

BozokMedia analysis shows that autonomous AI agents, if left unchecked, can become silent backdoors inside enterprises, bypassing traditional perimeter defenses and even advanced EDR solutions.

“Once the agent is inside, it acts as an invisible spy, continuously harvesting data and executing privileged actions.” – Cybersecurity expert Dr. Maya Patel

Frequently Asked Questions

Is this flaw limited to ChatGPT Workspace? Yes, it specifically targets the Agent Builder within the Workspace environment.

How did OpenAI remediate the issue? OpenAI tightened parameter validation, added additional authentication checks, and released a patch within four days of the report.