Zenity Labs has disclosed AgentForger, a vulnerability in OpenAI’s Workspace Agents that showed how a single manipulated ChatGPT link could create a rogue autonomous agent under a user’s account. OpenAI fixed the flaw within four days, according to The Decoder.
The attack abused URL parameters to hijack the victim’s app permissions, disable security controls, and set up an agent that checked an attacker-controlled inbox for new commands every five minutes. Because the agent ran inside the victim’s trusted workspace, it inherited already-authorized connectors and could bypass approval steps meant to protect sensitive actions.
Zenity describes the issue as an evolution of cross-site request forgery. Traditional CSRF tricks a browser into taking one unwanted authenticated action. AgentForger went further by creating a persistent agent that could keep acting after the initial click.
The incident is a warning about enterprise AI agents. Security tools built for apps and users may miss autonomous agents that operate with legitimate identities, scheduled tasks, and broad tool access unless companies monitor the agents themselves.