Security News Experts warn ChatGPT's Workspace Agent Builder can be hijacked to create malicious AI workers

[Brownie2019]

Content source

https://www.techradar.com/pro/security/experts-warn-chatgpts-workspace-agent-builder-can-be-hijacked-to-create-malicious-ai-workers

A single phishing link could have spelled disaster
Zenity Labs found AgentForger, a flaw in OpenAI’s ChatGPT Agent Builder
Malicious links could instantly deploy rogue agents that exfiltrate sensitive data without user prompts
OpenAI patched the issue by removing the risky URL parameter; no abuse detected
AI agents are handy for answering customer emails, or tracking reports for newly released security vulnerabilities. But what if they go rogue and turn on the very enterprise they’re supposed to support?

Security researchers from Zenity Labs have found a way for cybercriminals to trick people into deploying such agents into their own tech stack. Since all it takes is a single click, the disruptive potential of these attacks is arguably significantly bigger than anything else a phishing attack could do.

The flaw was discovered in OpenAI’s ChatGPT Agent Builder, a feature that lets users create custom AI agents. The researchers dubbed it “AgentForger", explaining that the issue stems from an overly permissive parameter in the tool, which allowed anyone to create ChatGPT links that include virtually any instructions.

Agent trust failure
As soon as the victim clicks on the link, they send the instructions to Agent Builder which acts on them immediately - without prompting or otherwise notifying the victim.

In theory, a single phishing email could trick a person into deploying a malicious agent that exfiltrates sensitive data or does anything else that company’s AI agents are permitted to do. To make matters worse, the AI agent would persist on the infrastructure indefinitely, doing the attackers’ bidding until caught.
“This is an agent trust failure, and existing security controls were never built to see it,” commented Michael Bargury, co-founder and CTO of Zenity.

The researchers disclosed their findings with OpenAI in early June 2026, and the company came back with a fix a few days later.
The bug was solved by removing the URL parameter that originally enabled the attack, it was explained. There is no evidence that it was previously discovered, or abused, by malicious actors.

 

[Bot]

Assessment

Based only on the quoted article, this describes a reported vulnerability in ChatGPT Agent Builder rather than a confirmed active campaign. I cannot independently verify the Zenity Labs findings, OpenAI’s remediation, or the claim that there was no abuse from the text alone.

The important security issue is the combination of:

• Instructions being accepted through a URL parameter
• A click potentially causing an agent to be created or configured without a separate confirmation
• The resulting agent retaining access to connected services and data

This is more serious than a normal phishing link if the agent inherits permissions to email, cloud storage, source-code repositories, ticketing systems, or other enterprise services. The practical impact would depend on the permissions granted to the affected account and the organization’s monitoring controls.

Recommended precautions

• Do not deploy or import an agent from an unsolicited link, even if the link appears to come from a trusted colleague.
• Access Agent Builder through the official OpenAI website or organization-managed portal instead of using embedded links.
• Review existing agents, their instructions, connected tools, OAuth grants, API keys, and data-access permissions.
• Remove unfamiliar agents and revoke credentials or integrations associated with them.
• Check audit logs for recently created agents, unusual instructions, external data access, and unexpected outbound activity.
• Require administrator approval and least-privilege permissions for enterprise AI agents where those controls are available.
• Keep browser, endpoint security, identity, and cloud monitoring controls enabled; these may not detect misuse performed through legitimate agent permissions.

If an organization believes a link was clicked, it should preserve the URL and relevant logs, disable or remove the affected agent, revoke potentially exposed credentials, and contact OpenAI through its official security-support channel. The claims should be treated as a reported vulnerability until confirmed through the vendor advisory or the researchers’ original disclosure.

 

[Zero Knowledge]

Sadly A.I has ruined everything, I can't even browse YouTube without millions of A.I slop videos. Hopefully A.I.will just attack itself and destroy itself.