On July 23, security firm Zenity Labs published a vulnerability report they had held for a month and a half: OpenAI's Workspace Agents contained a flaw named AgentForger, which allowed an attacker — by simply getting an employee to click on an innocuous-looking ChatGPT link — to plant a fully attacker-controlled autonomous AI agent inside the company's ChatGPT workspace.
The critical issue is not that the agent is just a chatbot. It inherited every enterprise app connector the victimized employee had already authorized in ChatGPT: Outlook, Teams, Slack, SharePoint, and Google Drive were all included. Whatever files the employee could read, the hijacked agent could read; whatever emails the employee could send, the agent could send as the employee themselves.
The root cause was remarkably small. Zenity CTO Michael Bargury summarized it in one line: "This isn't forged requests, this is a forged insider." The attacker stole no passwords and hijacked no browser sessions — they simply planted an AI "internal employee" that looked identical to the real person.
Timeline
- June 4: Zenity reported the issue to OpenAI through the Bugcrowd disclosure program
- June 5: OpenAI confirmed the same day
- ~June 9: OpenAI removed the URL parameter enabling the attack — fixed within 4 days
- July 23: Zenity publicly disclosed the vulnerability, after the patch
- No new OAuth authorization screens were triggered — the agent reused the user's existing connections
- It did not appear in anomalous login logs — to the system, it was just the user's own AI assistant doing its job
- Data exfiltration traveled through the employee's own email channel, which corporate mail gateways typically trust
- The agent received new instructions every 5 minutes via scheduled emails from the attacker, with
TASKin the subject line - https://www.morningstar.com/news/business-wire/20260723680415/
- https://www.theregister.com/security/2026/07/23/one-chatgpt-link-could-smuggle-a-rogue-ai-agent-into-your-company/5275116
OpenAI's response speed was publicly praised by Zenity, but the attack chain itself deserves more attention. Zenity presented 12+ PoC scenarios: automatically mapping the company's org chart, searching email archives for plaintext passwords, sending internal phishing using the employee's account, and laying groundwork for BEC (business email compromise).
Forensic Invisibility
The most insidious part of the whole attack is its "forensic stealth":
In short: this is the first concrete sample of a "systemic trust collapse" in enterprise AI agents. We used to say "AI agents exceed their permissions, a new security model is needed" — now Zenity has delivered an engineering sample of "one click to complete corporate identity takeover."
Two Directions Worth Tracking
1. OpenAI's "one-shot overloaded authorization" parameter is a common pattern in agent builders — other platforms are likely stepping in the same trap. Zenity demonstrated at Black Hat 2025 that Microsoft Copilot Studio, Salesforce Einstein, and Google Gemini all have agent takeover paths; AgentForger is the ChatGPT version of this attack class. 2. Existing EDR/SIEM/XDR tools are designed for "user + endpoint" — they are completely blind to "autonomous agents running as the user." What needs to be added is not rules but a new security semantic layer: code "running as my identity" must be treated differently from "me." There is no ready-made solution for this today.