{"schema_version":"0.8.0","id":"LR-2026-0090","record_version":12,"title":"AgentForger: CSRF via ChatGPT Workspace Agents Builder URL parameters forges attacker-controlled autonomous agent","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":56.3,"score_breakdown":{"source_authority":16.5,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":8.0,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true},"gate_version":"gate-2026-09-24.4","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-09-27","extraction_run_id":null},"system":{"model_name":"ChatGPT","model_version":null,"developer":"OpenAI","harness":"Workspace Agents Builder","tools_granted":["Outlook Email","Gmail","Calendars","Slack","Teams"],"permissions_scope":"Access to already-authorized connectors (Outlook, Gmail, Slack, Google Drive, SharePoint, Teams) in the victim's authenticated session","autonomy_level":"full-auto","guardrails_present":["action_approval"],"deployment_context":"production","tier":"provider","lifecycle_stage":"production","integration_type":"agentic_with_tools","intended_use":"Creating and running Workspace Agents that connect to services and execute actions on a schedule","safeguard_state":"Approval gate disabled; Outlook set to 'Never ask'","production_intended":true},"event":{"date_occurred":null,"date_disclosed":"2026-07-23","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":["credential_misuse"],"trigger":"prompt_injection","duration":null,"detection_method":"public_researcher","summary":"Zenity Labs found that OpenAI's Workspace Agents Builder accepted an initial_assistant_prompt URL parameter that was auto-submitted and executed, letting an attacker-controlled link create and publish an autonomous agent inside a logged-in victim's session.","tags":["csrf","prompt-injection","agent-creation","approval-bypass","persistence"],"date_detected":null,"near_miss":true,"root_cause":"integration","root_cause_detail":"The Builder treated the initial_assistant_prompt query parameter as executable input and allowed the same prompt to modify security-relevant configuration, including approval policies and execution schedules.","failure_class_detail":"An instruction embedded in a URL parameter was automatically submitted and executed by the Builder, causing it to create and publish an attacker-controlled agent.","responsible_party":"provider","adversarial_actor":"external_attacker","input_provenance":"attacker-controlled URL parameter initial_assistant_prompt","time_to_contain":null,"operations_paused":null,"remediation":"OpenAI fixed the vulnerability within 4 days of disclosure.","precursor_events":"Part 1 showed how a single malicious AgentForger link could forge an entire malicious insider within the org once clicked.","control_failure":[{"element_id":"C05","state":"bypassed","quote":"The mechanism intended to require human approval for sensitive actions can itself be disabled by the instructions being executed.","source_index":0},{"element_id":"C05","state":"bypassed","quote":"Because the prompt has already switched Outlook approvals to “Never ask,” the Preview run executes without showing an approval prompt.","source_index":0}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"minor: In Zenity Labs' demonstration, the forged agent operates inside the organization's trust boundary with access to connected services; the source describes recon, data harvesting, impersonation and business email compromise in its write-up, and names no real victim.","harm_class":["third_party_security"],"affected_description":"The victim's ChatGPT account and connected services (Outlook, Gmail, Slack, Google Drive, SharePoint, Teams)","protected_class_involved":null,"data_categories_exposed":["credentials","pii"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://labs.zenity.io/post/agentforger-part-1-chatgpt-cross-site-agent-forgery","publisher":"Zenity Labs","date":"2026-07-23","type":"vendor_research","title":"AgentForger, Part 1: ChatGPT Cross-Site Agent Forgery","archived_url":null},{"url":"https://labs.zenity.io/post/agentforger-part-2-the-autonomous-insider","publisher":"Zenity Labs","date":"2026-07-23","type":"vendor_research","title":"AgentForger, Part 2: The Autonomous Insider","archived_url":null,"attachment":"fingerprint"}],"per_field_confidence":{"system.model_name":"C","system.harness":"C","system.tools_granted":"C","system.permissions_scope":"C","system.guardrails_present":"C","system.tier":"D","system.lifecycle_stage":"D","system.integration_type":"D","system.intended_use":"C","system.safeguard_state":"C","system.production_intended":"D","system.developer":"C","system.autonomy_level":"D","system.deployment_context":"D","event.failure_class":"C","event.secondary_failure_classes":"D","event.tags":"C","event.near_miss":"D","event.root_cause":"C","event.adversarial_actor":"C","event.input_provenance":"C","event.remediation":"C","event.agent_involved":"C","event.trigger":"C","event.detection_method":"C","event.summary":"C","event.incident_class":"C","event.date_disclosed":"A","impact.harm_class":"D","impact.affected_description":"C","impact.severity":"D","context.industry":"D","context.denominator_available":"D","context.country":"D","event.root_cause_detail":"C","event.failure_class_detail":"C","impact.severity_because":"D","event.control_failure":"C","event.responsible_party":"C","event.precursor_events":"C","impact.data_categories_exposed":"C","context.systemic_exposure":"C","context.incident_evidence":"C"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"When a logged-in victim clicks the link, ChatGPT opens the Builder in the victim’s authenticated session and automatically submits the prompt embedded in the URL."},{"source_index":1,"quote":"In Part 1, we introduced AgentForger: a vulnerability in OpenAI's Workspace Agents that allowed a single ChatGPT link to build a malicious agentic insider within the victim’s organization."}],"system.developer":[{"source_index":0,"quote":"OpenAI's Workspace Agents can connect to Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams, execute actions across those services, and run on a schedule."},{"source_index":1,"quote":"In Part 1, we introduced AgentForger: a vulnerability in OpenAI's Workspace Agents that allowed a single ChatGPT link to build a malicious agentic insider within the victim’s organization."}],"system.harness":[{"source_index":0,"quote":"OpenAI's Workspace Agents can connect to Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams, execute actions across those services, and run on a schedule."}],"system.tools_granted":[{"source_index":0,"quote":"Attaches existing connectors, including Outlook Email and template defaults such as Gmail, Calendars, Slack, and Teams."}],"system.permissions_scope":[{"source_index":0,"quote":"The attack requires a victim who is logged into ChatGPT, has access to Workspace Agents, and has at least one authorized connector."}],"system.autonomy_level":[{"source_index":0,"quote":"The Builder treats the prompt as a to-do list and works through it autonomously."},{"source_index":1,"quote":"All of this happens without requiring any further interaction from the victim. The agent is operating in the background. The victim has no indication that anything is ever happening."}],"system.guardrails_present":[{"source_index":0,"quote":"Write actions default to “Always ask,” the control meant to stop an agent from silently sending mail or taking other sensitive actions."}],"system.deployment_context":[{"source_index":0,"quote":"When a logged-in victim clicks the link, ChatGPT opens the Builder in the victim’s authenticated session and automatically submits the prompt embedded in the URL."},{"source_index":1,"quote":"Once installed, the forged agent is not just a malicious prompt or a one-time CSRF action. It becomes a live autonomous operator inside the organization’s trust boundary."}],"system.lifecycle_stage":[{"source_index":0,"quote":"When a logged-in victim clicks the link, ChatGPT opens the Builder in the victim’s authenticated session and automatically submits the prompt embedded in the URL."},{"source_index":1,"quote":"Once installed, the forged agent is not just a malicious prompt or a one-time CSRF action. It becomes a live autonomous operator inside the organization’s trust boundary."}],"system.integration_type":[{"source_index":0,"quote":"OpenAI's Workspace Agents can connect to Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams, execute actions across those services, and run on a schedule."},{"source_index":1,"quote":"The scheduled task is what turns the forged agent into a persistent insider. It tells the agent to watch for emails from the attacker’s address, process any subject that starts with “TASK,” execute the instruction through connected apps, and send the results back to the same attacker-controlled email address."}],"system.intended_use":[{"source_index":0,"quote":"OpenAI's Workspace Agents can connect to Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams, execute actions across those services, and run on a schedule."}],"system.safeguard_state":[{"source_index":0,"quote":"Disables the approval gate."}],"system.production_intended":[{"source_index":0,"quote":"OpenAI's Workspace Agents can connect to Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams, execute actions across those services, and run on a schedule."}],"event.failure_class":[{"source_index":0,"quote":"That means an instruction embedded inside a URL can become the first command the Builder acts on."}],"event.secondary_failure_classes":[{"source_index":0,"quote":"Attaches existing connectors, including Outlook Email and template defaults such as Gmail, Calendars, Slack, and Teams."}],"event.trigger":[{"source_index":0,"quote":"That means an instruction embedded inside a URL can become the first command the Builder acts on."}],"event.detection_method":[{"source_index":0,"quote":"During our research, we discovered that this workflow could be driven entirely by an attacker-controlled URL."},{"source_index":1,"quote":"We reported this to OpenAI through their Bugcrowd vulnerability disclosure program."}],"event.summary":[{"source_index":0,"quote":"During our research, we discovered that this workflow could be driven entirely by an attacker-controlled URL."}],"event.tags":[{"source_index":0,"quote":"We call it AgentForger: a Cross-Site Request Forgery (CSRF) that doesn't forge a single request; it forges an entire autonomous agent, attacker-controlled and living inside your organization's trust boundary."}],"event.near_miss":[{"source_index":0,"quote":"During our research, we discovered that this workflow could be driven entirely by an attacker-controlled URL."}],"event.root_cause":[{"source_index":0,"quote":"The Builder treats the initial_assistant_prompt query parameter as executable input rather than user-supplied content requiring confirmation."},{"source_index":1,"quote":"At its core, AgentForger is an agent trust failure: the platform trusts that the user intentionally created, approved, scheduled, and operated the agent."}],"event.root_cause_detail":[{"source_index":0,"quote":"The Builder treats the initial_assistant_prompt query parameter as executable input rather than user-supplied content requiring confirmation."}],"event.adversarial_actor":[{"source_index":0,"quote":"During our research, we discovered that this workflow could be driven entirely by an attacker-controlled URL."},{"source_index":1,"quote":"The attacker sends a TASK email."}],"event.input_provenance":[{"source_index":0,"quote":"The prompt below is embedded in the initial_assistant_prompt URL parameter."}],"event.remediation":[{"source_index":0,"quote":"OpenAI resolved the vulnerability within 4 days of disclosure."}],"event.incident_class":[{"source_index":0,"quote":"During our research, we discovered that this workflow could be driven entirely by an attacker-controlled URL."},{"source_index":1,"quote":"Once installed, the forged agent is not just a malicious prompt or a one-time CSRF action. It becomes a live autonomous operator inside the organization’s trust boundary."}],"event.agent_involved":[{"source_index":0,"quote":"The Builder treats the prompt as a to-do list and works through it autonomously."},{"source_index":1,"quote":"The agent is not waiting for another click. It is waiting for instructions."}],"event.failure_class_detail":[{"source_index":0,"quote":"That means an instruction embedded inside a URL can become the first command the Builder acts on."}],"impact.harm_class":[{"source_index":0,"quote":"In Part 2, we follow the forged agent after it goes live and show the full blast radius."}],"impact.affected_description":[{"source_index":0,"quote":"The attack requires a victim who is logged into ChatGPT, has access to Workspace Agents, and has at least one authorized connector."}],"impact.severity_because":[{"source_index":0,"quote":"In Part 2, we follow the forged agent after it goes live and show the full blast radius."}],"context.industry":[{"source_index":0,"quote":"OpenAI's Workspace Agents can connect to Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams, execute actions across those services, and run on a schedule."}],"context.country":[{"source_index":0,"quote":"We reported this to OpenAI through their Bugcrowd vulnerability disclosure program."}],"impact.severity":[{"source_index":0,"quote":"In Part 2, we follow the forged agent after it goes live and show the full blast radius."},{"source_index":1,"quote":"The agent identifies an M&A term sheet, a board presentation that flags a revenue miss and planned headcount reduction, and a company-wide employee export containing contact and compensation data."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-07-23"}],"event.control_failure":[{"source_index":0,"quote":"The mechanism intended to require human approval for sensitive actions can itself be disabled by the instructions being executed."},{"source_index":0,"quote":"Because the prompt has already switched Outlook approvals to “Never ask,” the Preview run executes without showing an approval prompt."}],"system.tier":[{"source_index":1,"quote":"We reported this to OpenAI through their Bugcrowd vulnerability disclosure program. OpenAI resolved the vulnerability within 4 days of disclosure."}],"event.responsible_party":[{"source_index":1,"quote":"We reported this to OpenAI through their Bugcrowd vulnerability disclosure program. OpenAI resolved the vulnerability within 4 days of disclosure."}],"event.precursor_events":[{"source_index":1,"quote":"Part 1 showed how a single malicious AgentForger link could forge an entire malicious insider within the org once clicked."}],"impact.data_categories_exposed":[{"source_index":1,"quote":"The agent searches Slack through the victim’s connected workspace, finds messages containing passwords, organizes the results into a table, and emails them back to the attacker."},{"source_index":1,"quote":"The agent identifies an M&A term sheet, a board presentation that flags a revenue miss and planned headcount reduction, and a company-wide employee export containing contact and compensation data."}],"context.systemic_exposure":[{"source_index":1,"quote":"That lesson is bigger than one vulnerability or one platform."}],"context.incident_evidence":[{"source_index":1,"quote":"We reported this to OpenAI through their Bugcrowd vulnerability disclosure program."}]},"notes_on_gaps":"No source states event.date_occurred, event.date_detected, event.duration, event.time_to_contain, impact.direct_loss_usd, impact.records_exposed, impact.third_parties_affected_count, impact.loss_range_usd, impact.downstream_exposure_count, context.org_size_band, context.denominator, context.regulatory, context.coverage, or context.incident_evidence. system.model_version is not disclosed. system.tier is derived by rule and not written. event.date_disclosed is derived by rule and not written. event.trigger is stated as prompt_injection by the source. event.root_cause is stated as integration by the source. Judgements: system.autonomy_level full-auto from the Builder working through the prompt autonomously; system.deployment_context production from the live ChatGPT session; system.lifecycle_stage production; system.integration_type agentic_with_tools; system.production_intended true; event.secondary_failure_classes credential_misuse from the agent attaching existing connectors; event.near_miss true because the vulnerability was found in research before exploitation; impact.harm_class third_party_security; impact.reversibility reversible because OpenAI fixed it; impact.severity_because major from the unbounded scope described in Part 2; context.industry Information; context.country US; context.systemic_exposure false because the attack requires a specific victim with connectors. system.tier: provider by rule (the developer is named as the operator). [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-09-29] system.lifecycle_stage: production. system.integration_type: agentic_with_tools. system.production_intended: production. system.autonomy_level: a source states no person was in the loop while it ran (not: silence about a human is not a statement that none was there). system.deployment_context: production. event.secondary_failure_classes: a source states the agent used a credential, key or token for a purpose or scope it was not granted. event.near_miss: no loss materialised because the failure was caught first. event.responsible_party: provider. impact.harm_class: third_party_security. impact.reversibility: reversible. context.industry: Information. context.systemic_exposure: false. context.denominator_available: no denominator is available for this incident. context.country: US. [control failure inferred by deepseek-chat, controlfail-2026-10-11.2, 2026-10-11] [corrected by Srini Iyer, approved 2026-10-18 in the corrections review: severity reason printed the whole rubric] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a judgement inferred by us that no source states was cleared] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: severity reason did not fit its quote or the record] Merged with LR-2026-0091, which described the same incident; their sources are included here. [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: duplicate of another record, merged] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: citations to sentences about a different event were removed] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: severity reason did not fit its quote or the record]"},"context":{"industry":"Information","org_size_band":null,"country":"US","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":true,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":{"log_completeness":null,"tamper_evidence":null,"timestamp_reliability":null,"investigation_independence":"internal","redaction_summary":null,"analysis_method":"human_review","prompt_output_retention":null},"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"OpenAI's Workspace Agents Builder was used to create and publish an autonomous agent that could connect to Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams, execute actions, and run on a schedule.","quote":"OpenAI's Workspace Agents can connect to Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams, execute actions across those services, and run on a schedule.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"An attacker-controlled URL parameter was auto-submitted and executed, causing the Builder to create and publish an attacker-controlled agent, disable the approval gate, and install recurring schedules without user interaction.","quote":"That means an instruction embedded inside a URL can become the first command the Builder acts on.","source_index":0,"grade":"C"},{"step":"reached","text":"The forged agent attached the victim's already-authorized connectors, including Outlook Email, Gmail, Calendars, Slack, and Teams, and could access sensitive data and send results out.","quote":"Attaches existing connectors, including Outlook Email and template defaults such as Gmail, Calendars, Slack, and Teams.","source_index":0,"grade":"C"},{"step":"caught","text":"Zenity Labs researchers discovered the vulnerability during their research.","quote":"During our research, we discovered that this workflow could be driven entirely by an attacker-controlled URL.","source_index":0,"grade":"C"},{"step":"done","text":"Zenity reported the vulnerability to OpenAI via Bugcrowd on June 4, 2026; OpenAI fixed it by June 8, 2026.","quote":"We reported this to OpenAI through their Bugcrowd vulnerability disclosure program.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-09-29","source_urls":["https://labs.zenity.io/post/agentforger-part-1-chatgpt-cross-site-agent-forgery"]},"analysis":{"sections":{"timeline":[{"text":"Zenity Labs reported the AgentForger vulnerability to OpenAI through Bugcrowd on June 4, 2026.","quote":"June 4, 2026: Reported to OpenAI via Bugcrowd.","source_index":0,"when":"June 4, 2026"},{"text":"Bugcrowd triaged the report on June 5, 2026.","quote":"June 5, 2026: Triaged by Bugcrowd.","source_index":0,"when":"June 5, 2026"},{"text":"OpenAI accepted the vulnerability on June 5, 2026.","quote":"June 5, 2026: Accepted by OpenAI.","source_index":0,"when":"June 5, 2026"},{"text":"OpenAI fixed the vulnerability on June 8, 2026, within 4 days of disclosure.","quote":"June 8, 2026: Fixed by OpenAI.","source_index":0,"when":"June 8, 2026"}],"actors":[{"text":"OpenAI's Workspace Agents can connect to Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams, execute actions across those services, and run on a schedule.","quote":"OpenAI's Workspace Agents can connect to Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams, execute actions across those services, and run on a schedule.","source_index":0,"when":null},{"text":"The attack requires a victim who is logged into ChatGPT, has access to Workspace Agents, and has at least one authorized connector.","quote":"The attack requires a victim who is logged into ChatGPT, has access to Workspace Agents, and has at least one authorized connector.","source_index":0,"when":null}],"coordination":[{"text":"The attacker sends a phishing link containing the initial_assistant_prompt parameter; when the victim clicks it, ChatGPT opens the Builder in the victim's authenticated session and automatically submits the prompt.","quote":"When a logged-in victim clicks the link, ChatGPT opens the Builder in the victim’s authenticated session and automatically submits the prompt embedded in the URL.","source_index":0,"when":null},{"text":"The forged agent checks the user's email inbox for attacker-controlled instructions, so the attacker only needs to send an email to task it.","quote":"The agent can continue waking up on its schedule, checking the user’s email inbox for attacker-controlled instructions (all the attacker needs to do is send an email), carrying out new instructions with the victim’s connected services, and sending results back out.","source_index":0,"when":null}],"techniques":[{"text":"The Builder accepts initialization state through URL parameters, specifically template_name and initial_assistant_prompt.","quote":"During testing, we found that the Builder accepts initialization state through URL parameters.","source_index":0,"when":null},{"text":"The template_name parameter selects a starter agent template, such as template_name=chief-of-staff opening the Builder with the 'Chief of Staff' template preselected.","quote":"The template_name parameter selects a starter agent template.","source_index":0,"when":null},{"text":"The initial_assistant_prompt parameter provides instructions to the Builder, and when the page loads, its value is automatically submitted and executed.","quote":"We found that when the page loads, the value of initial_assistant_prompt is not merely placed into the prompt box.","source_index":0,"when":null},{"text":"The Builder creates an agent from the chief-of-staff template and names it 'TASK Mail Operator.'","quote":"Creates an agent from the chief-of-staff template and names it “TASK Mail Operator.”","source_index":0,"when":null},{"text":"The Builder attaches existing connectors, including Outlook Email and template defaults such as Gmail, Calendars, Slack, and Teams, without a new consent screen.","quote":"Attaches existing connectors, including Outlook Email and template defaults such as Gmail, Calendars, Slack, and Teams.","source_index":0,"when":null},{"text":"The prompt instructs the Builder to switch Outlook approvals to 'Never ask,' disabling the approval gate.","quote":"The prompt instructs the Builder to switch Outlook to “Never ask.”","source_index":0,"when":null},{"text":"The Builder publishes the agent live and installs multiple recurring hourly schedules, offset from one another to create effective check-ins every five minutes.","quote":"Publishes the agent live and installs multiple recurring hourly schedules, offset from one another to create effective check-ins every five minutes.","source_index":0,"when":null},{"text":"The Builder invokes Preview Mode to run immediately, executing the newly created agent against the victim's connected accounts using the approval settings just configured.","quote":"Invokes Preview Mode to run immediately.","source_index":0,"when":null}],"concealment":[{"text":"The attack does not need to trigger a new OAuth consent screen because the connectors were already authorized by the victim during prior ChatGPT use.","quote":"Because that connection already exists, the attack does not need to trigger a new OAuth consent screen.","source_index":0,"when":null},{"text":"Because the prompt switched Outlook approvals to 'Never ask,' the Preview run executes without showing an approval prompt.","quote":"Because the prompt has already switched Outlook approvals to “Never ask,” the Preview run executes without showing an approval prompt.","source_index":0,"when":null}],"enabling_conditions":[{"text":"The Builder treats the initial_assistant_prompt query parameter as executable input rather than user-supplied content requiring confirmation.","quote":"The Builder treats the initial_assistant_prompt query parameter as executable input rather than user-supplied content requiring confirmation.","source_index":0,"when":null},{"text":"The Builder allows the same prompt to modify security-relevant configuration, including approval policies and execution schedules.","quote":"The Builder allows the same prompt to modify security-relevant configuration, including approval policies and execution schedules.","source_index":0,"when":null},{"text":"The mechanism intended to require human approval for sensitive actions can itself be disabled by the instructions being executed.","quote":"The mechanism intended to require human approval for sensitive actions can itself be disabled by the instructions being executed.","source_index":0,"when":null}],"detection":[{"text":"Zenity Labs discovered the vulnerability during their research.","quote":"During our research, we discovered that this workflow could be driven entirely by an attacker-controlled URL.","source_index":0,"when":null}],"impact":[{"text":"The forged agent becomes a persistent operator that can continue waking up on its schedule, checking the user's email inbox for attacker-controlled instructions, carrying out new instructions with the victim's connected services, and sending results back out.","quote":"In other words, the forged agent becomes a persistent operator.","source_index":0,"when":null},{"text":"In Part 2, the researchers use the same command channel to task the forged agent to recon the organization, find sensitive data, harvest credentials, impersonate the victim, deliver internal phishing, and stage business email compromise.","quote":"With the operator live, we use the same command channel to task the forged agent like an attacker would: recon the organization, find sensitive data, harvest credentials, impersonate the victim, deliver internal phishing, and stage business email compromise.","source_index":0,"when":null}],"open_questions":[{"text":"The full blast radius of the forged agent after it goes live is covered in Part 2, which is not included in this chunk.","quote":"In Part 2, we follow the forged agent after it goes live and show the full blast radius.","source_index":0,"when":null}]},"model":"deepseek-chat","prompt_version":"deepdive-2026-09-27.1","extracted_at":"2026-09-27","source_urls":["https://labs.zenity.io/post/agentforger-part-1-chatgpt-cross-site-agent-forgery"]}}