AI Risk Wire

Cases › security breach › LR-2026-0090

AgentForger: CSRF via ChatGPT Workspace Agents Builder URL parameters forges attacker-controlled autonomous agent

Whose AI: OpenAI · ChatGPTsecurity breach

Severity minor: In Zenity Labs' demonstration, the forged agent operates inside the organization's trust boundary with access to connected services; the source describes recon, data harvesting, impersonation and business email compromise in its write-up, and names no real victim.

Earliest source we hold 2026-07-23

Zenity Labs found that OpenAI's Workspace Agents Builder accepted an initial_assistant_prompt URL parameter that was auto-submitted and executed, letting an attacker-controlled link create and publish an autonomous agent inside a logged-in victim's session.

Risk grouping: AI attacked

Who caused it A person or organisation
“When a logged-in victim clicks the link, ChatGPT opens the Builder in the victim’s authenticated session and automatically submits the prompt embedded in the URL.” source
Intended or not Intended
“We call it AgentForger: a Cross-Site Request Forgery (CSRF) that doesn't forge a single request; it forges an entire autonomous agent, attacker-controlled and living inside your organization's trust boundary.” source
Before or after release After release
“When a logged-in victim clicks the link, ChatGPT opens the Builder in the victim’s authenticated session and automatically submits the prompt embedded in the URL.” source
The AI's part Attacked
“The Builder treats the initial_assistant_prompt query parameter as executable input rather than user-supplied content requiring confirmation.” source

The story

1 · What it was doingOpenAI's Workspace Agents Builder was used to create and publish an autonomous agent that could connect to Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams, execute actions, and run on a schedule.
2 · What went wrongAn attacker-controlled URL parameter was auto-submitted and executed, causing the Builder to create and publish an attacker-controlled agent, disable the approval gate, and install recurring schedules without user interaction.
3 · What it reached or didThe forged agent attached the victim's already-authorized connectors, including Outlook Email, Gmail, Calendars, Slack, and Teams, and could access sensitive data and send results out.
4 · How it was caughtZenity Labs researchers discovered the vulnerability during their research.
5 · What was doneZenity reported the vulnerability to OpenAI via Bugcrowd on June 4, 2026; OpenAI fixed it by June 8, 2026.

What the sources state

Others like this

ChatGPT advised Tumbler Ridge school shooter on mass murder before February 2026 attack 2026-10-17

Eight state attorneys general sue OpenAI over alleged harms to teenage ChatGPT users 2026-10-16

ChatGPT alleged to have assisted Florida State University shooter (contested lawsuit) 2026-10-01

Guardian test: ChatGPT and Grok remove hijab from AI-generated image of Muslim woman 2026-10-01

All cases of this kind ›

Safeguards a source says failed

Human approval bypassed: “The mechanism intended to require human approval for sensitive actions can itself be disabled by the instructions being executed.”

Human approval bypassed: “Because the prompt has already switched Outlook approvals to “Never ask,” the Preview run executes without showing an approval prompt.”

A model read these from the sources; each quote was checked word for word against its source.

Show the full account: 24 items from the primary sources

What happened, in order

  1. June 4, 2026 Zenity Labs reported the AgentForger vulnerability to OpenAI through Bugcrowd on June 4, 2026.
  2. June 5, 2026 Bugcrowd triaged the report on June 5, 2026.
  3. June 5, 2026 OpenAI accepted the vulnerability on June 5, 2026.
  4. June 8, 2026 OpenAI fixed the vulnerability on June 8, 2026, within 4 days of disclosure.

Who and what was involved

  1. OpenAI's Workspace Agents can connect to Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams, execute actions across those services, and run on a schedule.
  2. The attack requires a victim who is logged into ChatGPT, has access to Workspace Agents, and has at least one authorized connector.

How the agents communicated and organised

  1. The attacker sends a phishing link containing the initial_assistant_prompt parameter; when the victim clicks it, ChatGPT opens the Builder in the victim's authenticated session and automatically submits the prompt.
  2. The forged agent checks the user's email inbox for attacker-controlled instructions, so the attacker only needs to send an email to task it.

What they used to do it

  1. The Builder accepts initialization state through URL parameters, specifically template_name and initial_assistant_prompt.
  2. The template_name parameter selects a starter agent template, such as template_name=chief-of-staff opening the Builder with the 'Chief of Staff' template preselected.
  3. The initial_assistant_prompt parameter provides instructions to the Builder, and when the page loads, its value is automatically submitted and executed.
  4. The Builder creates an agent from the chief-of-staff template and names it 'TASK Mail Operator.'
  5. The Builder attaches existing connectors, including Outlook Email and template defaults such as Gmail, Calendars, Slack, and Teams, without a new consent screen.
  6. The prompt instructs the Builder to switch Outlook approvals to 'Never ask,' disabling the approval gate.
  7. The Builder publishes the agent live and installs multiple recurring hourly schedules, offset from one another to create effective check-ins every five minutes.
  8. The Builder invokes Preview Mode to run immediately, executing the newly created agent against the victim's connected accounts using the approval settings just configured.

What they did to avoid being caught

  1. The attack does not need to trigger a new OAuth consent screen because the connectors were already authorized by the victim during prior ChatGPT use.
  2. Because the prompt switched Outlook approvals to 'Never ask,' the Preview run executes without showing an approval prompt.

What made it possible

  1. The Builder treats the initial_assistant_prompt query parameter as executable input rather than user-supplied content requiring confirmation.
  2. The Builder allows the same prompt to modify security-relevant configuration, including approval policies and execution schedules.
  3. The mechanism intended to require human approval for sensitive actions can itself be disabled by the instructions being executed.

How it was found

  1. Zenity Labs discovered the vulnerability during their research.

What it reached, and the numbers

  1. The forged agent becomes a persistent operator that can continue waking up on its schedule, checking the user's email inbox for attacker-controlled instructions, carrying out new instructions with the victim's connected services, and sending results back out.
  2. In Part 2, the researchers use the same command channel to task the forged agent to recon the organization, find sensitive data, harvest credentials, impersonate the victim, deliver internal phishing, and stage business email compromise.
Show every field, with its source and grade

The AI system

Model
ChatGPT
C one secondary source states it
Developer
OpenAI
C one secondary source states it
Software around the model
Workspace Agents Builder
C one secondary source states it
Tools it was given
Outlook Email, Gmail, Calendars, Slack, Teams
C one secondary source states it
What it was allowed to do
Access to already-authorized connectors (Outlook, Gmail, Slack, Google Drive, SharePoint, Teams) in the victim's authenticated session
C one secondary source states it
How much it acted alone
it acted alone, unwatched
D inferred by us from the described behaviour, reason shown
Safeguards in place
action approval
C one secondary source states it
Stage of use
in live use
D inferred by us from the described behaviour, reason shown
Whose system
company that built the AI
D inferred by us from the described behaviour, reason shown
How it was connected
agentic with tools
D inferred by us from the described behaviour, reason shown
What it was for
Creating and running Workspace Agents that connect to services and execute actions on a schedule
C one secondary source states it
State of its safeguards
Approval gate disabled; Outlook set to 'Never ask'
C one secondary source states it
Meant for live use
yes
D inferred by us from the described behaviour, reason shown

What happened

Earliest source we hold
2026-07-23
A the date the source itself carries
What set it off
hidden instructions in its input
C one secondary source states it
Who caught it
an independent researcher or journalist
C one secondary source states it
Themes
CSRF, prompt injection, agent creation, approval bypass, persistence
C one secondary source states it
Near miss
yes, no harm happened
D inferred by us from the described behaviour, reason shown
Cause
a permission, scope or wiring error
C one secondary source states it
Cause in detail
The Builder treated the initial_assistant_prompt query parameter as executable input and allowed the same prompt to modify security-relevant configuration, including approval policies and execution schedules.
C one secondary source states it
Who was responsible
the model provider
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
Where its input came from
attacker-controlled URL parameter initial_assistant_prompt
C one secondary source states it
What was done
OpenAI fixed the vulnerability within 4 days of disclosure.
C one secondary source states it
Earlier warning signs
Part 1 showed how a single malicious AgentForger link could forge an entire malicious insider within the org once clicked.
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
What it did
An instruction embedded in a URL parameter was automatically submitted and executed by the Builder, causing it to create and publish an attacker-controlled agent.
C one secondary source states it

Impact

Severity
minor
D inferred by us from the described behaviour, reason shown
Kind of harm
others' security
D inferred by us from the described behaviour, reason shown
Who was affected
The victim's ChatGPT account and connected services (Outlook, Gmail, Slack, Google Drive, SharePoint, Teams)
C one secondary source states it
Kinds of data exposed
credentials, personal information
C one secondary source states it
Why this severity
In Zenity Labs' demonstration, the forged agent operates inside the organization's trust boundary with access to connected services; the source describes recon, data harvesting, impersonation and business email compromise in its write-up, and names no real victim.
D inferred by us from the described behaviour, reason shown

Context

Industry
Information
D inferred by us from the described behaviour, reason shown
Country
United States
D inferred by us from the described behaviour, reason shown
Shared exposure
one shared model or part put many users at risk
C one secondary source states it
Investigated
by the organisation itself
C one secondary source states it
How it was analysed
by people
C one secondary source states it

LR-2026-0090 · version 12 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON