A flaw in the way ChatGPT handled Workspace Agents could have allowed for serious cross-site request forgery attacks.
According to researcher Mike Takahashi of Zenity Labs, a flaw dubbed AgentForger could allow for the creation of ChatGPT agents that are able to harvest account credentials and spy on users across multiple accounts with persistence.
Zenity demonstrated the attack scenario in a post Thursday showing the forged agent’s post-exploitation reach. OpenAI fixed the bug, surfaced through the Bugcrowd, a crowdsourced cybersecurity platform, four days after it was alerted to it on June 8, said Zenity Labs.
There is no indication the flaw was ever exploited in the wild, researchers said. OpenAI did not respond to a request for comment by publication time.
Breaking down the bug
The flaw exists in the way ChatGPT allows users to create AI-powered agents that can perform multiple everyday tasks, such as checking and responding to emails or filtering out junk messages. The agents can be programmed to act across multiple services such as Outlook, Gmail, Slack, Google Drive, SharePoint and Microsoft Teams.
The forged agent at the center of Zenity Labs’ research doesn’t need to steal a password or a session token. It just needs a click. From there, it inherits everything the victim already had authorized — no new login screen, no second consent prompt, nothing to tip anyone off.
The opening for an adversary is in the tool ChatGPT uses to create these agents in the first place, called the Builder. Normally, setting a ChatGPT Builder up is a guided process. First, pick a template, describe what you want it to do, connect your apps, decide what needs your approval, test it, publish it.
Before the click — nothing has happened yet
You’re a normal ChatGPT user. You’re logged in. You’ve got Workspace Agents access, and you’ve already connected an app or two — Outlook, Slack, whatever you use day to day. None of that is a vulnerability by itself. It’s just ordinary use.
Separately, and with no involvement from you, an attacker has built one malicious link. It’s a real chatgpt.com web address, pointed at the Builder, with two things stuffed into its parameters: which template to use, and a full set of instructions for what the agent should do. That link gets dropped into a phishing email made to look routine.
The email lands in your inbox
Receiving it does nothing. Opening it, previewing it, reading it — none of that triggers anything. The email itself is inert. It’s just a container for the link.
The click — this is the entire attack
You click the link inside the email. That’s the one and only action required of you.
Because you’re already logged into ChatGPT, the link opens inside your own active, authenticated session — not a new login, not a new tab asking you to sign in as someone else. To ChatGPT, this looks exactly like you navigating to the Builder yourself.
The page loads with the attacker’s template and instructions already filled in from the URL. And here’s the actual flaw: rather than dropping those instructions into the prompt box for you to read and submit, the Builder submits and runs them automatically, the instant the page loads.
What happens next — no longer requires you at all
From that single click, in your session, with your permissions:
- The Builder connects every app you’d already authorized — no new consent screens, because those connections already existed.
- It sets your approval settings to “never ask,” so nothing it does afterward needs a sign-off from you.
- It schedules itself to run repeatedly.
- It publishes and goes live immediately.
You don’t need to click anything else. You don’t need to leave the tab open. You don’t even need to go back to ChatGPT again. The agent just keeps running on its own schedule from here — checking for instructions from the attacker and acting on your behalf, using your access.
Takahashi adds the attack also opens the possibility for remote control of the targeted system. Once commandeered, the forged agent can be configured to check the victim’s inbox every five minutes and look for new mail from the attacker’s address and the subject line starting with “task” – allowing for new instructions. That turns the victim’s own inbox into a command channel.
Zenity’s proof-of-concept put that command channel to work. One task had the agent map the org — people, roles, active projects, Slack channels — and email the results back in a single run. Another sent it hunting through Drive, SharePoint and email, where it turned up an M&A term sheet and a board deck flagging a revenue miss.
A third had it search Slack for the string “pass:” and hand back a table of exposed credentials. A fourth had it send a Teams message, under the victim’s own name, luring coworkers to a fake SSO login page. Zenity also tested a wire-fraud lure requesting a $242,500 transfer.
What is a cross-site request forgery attack, in AI terms?
A cross-site request forgery tricks a browser into sending a request the user never intended, using credentials the user is already logged into. The browser can’t tell the difference between a click that was meant and one that was manufactured. Websites defend against it with tokens the forged request can’t produce.
An AI agent isn’t a browser holding a session token. It’s software that reads instructions and acts on them, across accounts, on a schedule, without anyone watching. A CSRF-style attack against an agent doesn’t forge one request — it forges the agent. That’s Zenity’s distinction with “AgentForger”: not a new bug class, but an old one aimed at a target that didn’t exist before.
This isn’t the first time
- ChatGPT plugins, 2023. Researcher Johann Rehberger documented “Cross Plugin Request Forgery” — a malicious site hijacking a ChatGPT session through plugins like WebPilot to exfiltrate conversation history.
- EchoLeak, June 2025. Aim Security disclosed CVE-2025-32711, a 9.3-rated flaw in Microsoft 365 Copilot. One crafted email, no click required, leaked Teams and SharePoint data. Microsoft patched it and found no evidence of in-the-wild exploitation.
- AgentFlayer, August 2025. Zenity Labs showed zero-click compromises across ChatGPT, Copilot Studio, Salesforce Einstein and Gemini at Black Hat. CTO Michael Bargury called it a pattern across agentic AI, not one product’s bug.
AgentForger’s mechanism isn’t new. Its payload is: earlier flaws leaked data once. This one builds something that keeps running.
