One tampered ChatGPT link could spawn a rogue AI agent that took orders from an attacker every five minutes
Zenity Labs identified "AgentForger," a critical vulnerability in OpenAI Workspace Agents allowing attackers to create autonomous AI agents via a single manipulated URL. The exploit bypasses standard security controls by automatically submitting prompts, reusing existing app permissions, and disabling approval requirements without user interaction. Attackers can establish persistent command-and-control channels by scheduling agents to execute tasks (e.g., data exfiltration) at regular intervals
Analysis
TL;DR
- Zenity Labs identified "AgentForger," a critical vulnerability in OpenAI Workspace Agents allowing attackers to create autonomous AI agents via a single manipulated URL.
- The exploit bypasses standard security controls by automatically submitting prompts, reusing existing app permissions, and disabling approval requirements without user interaction.
- Attackers can establish persistent command-and-control channels by scheduling agents to execute tasks (e.g., data exfiltration) at regular intervals using the victim's inbox as a communication channel.
- The vulnerability represents an evolution of Cross-Site Request Forgery (CSRF), where the forged action is not a single request but a fully autonomous agent operating under legitimate user identity.
- OpenAI patched the issue within four days, highlighting the urgent need for security frameworks capable of monitoring autonomous agent behavior rather than just static user actions.
Why It Matters
This incident demonstrates a significant shift in AI security risks, moving from simple prompt injection or data leakage to the creation of persistent, autonomous malicious actors within enterprise environments. For AI practitioners and security teams, it underscores that traditional perimeter defenses are insufficient against threats that leverage legitimate user identities and pre-approved integrations to operate invisibly. The ability to turn a user's own workspace tools into a remote-controlled botnet requires a fundamental redesign of how AI agents are authenticated, authorized, and monitored.
Technical Details
- Vulnerability Mechanism: The flaw resides in the Agent Builder interface (
chatgpt.com/agents/studio/new), which acceptstemplate_nameandinitial_assistant_promptURL parameters. Unlike typical implementations, the page automatically submits and executes the provided prompt without requiring further user confirmation. - Permission Hijacking: The attack leverages existing OAuth connections (Outlook, Slack, Drive, etc.) that the victim has already authorized. By embedding instructions in the URL, the attacker forces the agent to change permission settings to "Never ask," effectively disabling multi-factor approvals for sensitive actions.
- Persistence and Scheduling: The generated agent includes a scheduler that triggers execution every five minutes. This transforms the one-time CSRF-like exploit into a persistent backdoor, allowing the attacker to send commands via email subject lines (e.g., "TASK") which the agent retrieves and executes autonomously.
- Execution Environment: The "Preview Mode" in the Agent Builder was exploited not as a dry run but as an active execution environment. It ran the newly created agent against real connected accounts immediately upon creation, bypassing safety checks because all approval gates had been disabled by the injected prompt.
- Impact Scope: Demonstrated capabilities included comprehensive organizational reconnaissance (mapping users, projects, and meetings) and sensitive data exfiltration (finding M&A documents, employee data, and credentials in Slack).
Industry Insight
- Redefine Zero Trust for AI Agents: Security models must assume that any user with API access can be coerced into creating malicious autonomous entities. Implement strict validation for any automated agent creation workflows, ensuring that critical configuration changes require explicit, multi-step human confirmation.
- Monitor Agent Behavior, Not Just Inputs: Traditional security tools monitor user clicks and requests. Organizations need behavioral analytics specifically designed for AI agents to detect anomalies such as scheduled recurring tasks, unusual data access patterns, or unauthorized permission modifications.
- Audit Third-Party Integrations Proactively: Since the attack relied on pre-existing trusted connections, enterprises should regularly audit and restrict the scope of permissions granted to AI tools. Implementing least-privilege principles for connector integrations can limit the blast radius of such exploits.
Disclaimer: The above content is generated by AI and is for reference only.