On July 23, security firm Zenity Labs published a vulnerability report they had held for a month and a half: OpenAI's Workspace Agents contained a flaw dubbed AgentForger. By getting an employee to click a seemingly ordinary ChatGPT link, an attacker could "plant" a fully attacker-controlled autonomous AI agent inside the company's ChatGPT workspace.
The key point is not that this agent was just a chatbot — it inherited all the enterprise app connectors the victim employee had already authorized in ChatGPT: Outlook, Teams, Slack, SharePoint, Google Drive, and more. Whatever files the employee could read, the forged agent could read; whatever emails the employee could send, the agent could send as the employee themselves.
The root cause was remarkably small. Zenity CTO Michael Bargury summarized it in one line: "This is not forging a request — this is forging an insider employee." The attacker stole no passwords and no browser sessions; they simply planted an AI insider that looked identical to the real employee.
Disclosure timeline
- June 4: Zenity reported the issue to OpenAI via the Bugcrowd disclosure program
- June 5: OpenAI confirmed the same day
- ~June 9: OpenAI removed the URL parameter enabling the attack — fixed within 4 days
- July 23: Zenity publicly disclosed the vulnerability, after it was patched
- No new OAuth authorization screen is triggered — the agent reuses the user's existing connections
- It never appears in anomalous login logs — to the system, it is just the user's own AI assistant doing its job
- Data exfiltration goes through the employee's own email channel, which corporate mail gateways typically trust
- The agent receives new instructions every 5 minutes, via scheduled emails from the attacker with
TASKin the subject line - Press coverage: https://www.morningstar.com/news/business-wire/20260723680415/ or https://www.theregister.com/security/2026/07/23/one-chatgpt-link-could-smuggle-a-rogue-ai-agent-into-your-company/5275116
- Full technical analysis: Zenity Labs at labs.zenity.io
- Lead researcher Michael Bargury (CTO) publicly described the flaw as a "forged insider."
OpenAI's response speed was publicly praised by Zenity, but the attack chain itself is the more important story. Zenity demonstrated over 12 PoC scenarios: automatically mapping corporate org charts, searching email archives for plaintext passwords, sending internal phishing using the employee's account, and paving the way for BEC (Business Email Compromise).
Why forensics would miss it
The most insidious aspect of the whole attack is its "forensic invisibility":
In short: this is the first concrete sample of "systemic trust collapse" for enterprise AI agents. We used to say "AI agents need new security models for authorization"; now Zenity has delivered an engineering sample of "one-click corporate identity takeover."
Two directions worth tracking
1. OpenAI's "one-shot overloaded authorization" parameter is a common pattern in agent builders — other platforms are likely stepping in the same pit. Zenity already demonstrated at Black Hat 2025 that Microsoft Copilot Studio, Salesforce Einstein, and Google Gemini all have agent-takeover paths; AgentForger is the ChatGPT version of this attack class. 2. Existing EDR/SIEM/XDR tools are designed for "user + endpoint" and are completely blind to "autonomous agents running as the user." What needs to be added is not more rules but a new security semantic layer — code running under my identity must be treated differently from me. There is no off-the-shelf solution for this today.