AgentForger: one ChatGPT link forges an AI insider

Every AI assistant on your team is holding a stack of standing grants: Outlook, Slack, Drive, SharePoint. Each one got approved once, by someone, months ago, and then stopped being a decision. On July 23 Zenity Labs published AgentForger — a ChatGPT flaw that turned one link into a permanent, attacker-controlled agent wearing every one of those grants at once. OpenAI fixed the bug. The shape of it is not fixed.

What actually happened

AgentForger abused two initialization parameters on ChatGPT's agent builder at chatgpt.com/agents/studio/new: template_name and initial_assistant_prompt. Per Zenity's write-up, the attacker's prompt auto-submitted on page load — no confirmation dialog, no second click. A logged-in victim opening the link got an agent constructed inside their own authenticated session.

What the forged agent did next is the part worth reading twice. It attached the connectors the user had already authorized — Outlook, Gmail, Slack, Google Drive, SharePoint, Teams. It flipped write approvals from "Always ask" to "Never ask." Then it scheduled itself to poll the victim's mailbox roughly every five minutes for incoming commands, execute them across those connected systems, and mail results back to an attacker-controlled address. The Register reports the commands arrived as ordinary email with an attacker-chosen subject line. Zenity CTO Michael Bargury's summary: "This isn't a forged request, it's a forged insider."

Disclosure was clean and fast — reported via Bugcrowd on June 4, triaged June 5, resolved by June 8, published only after the fix. There's no reported exploitation in the wild.

Why AI agent security is now an access problem

Patch anxiety is the wrong takeaway here. This one is already closed, and it was ChatGPT-specific. The durable lesson is that an OAuth grant to an AI tool is not a login — it's a delegation that outlives the session. Every connector you approve becomes ambient authority that anything running inside that tool inherits, including something an attacker builds there.

That reframes three ordinary decisions. First, connector scope: "read my calendar" and "send mail as me" are wildly different grants, and most teams approve both with the same click. Second, approval gates on write actions are a control, not friction — if a platform lets an agent silently switch them off, that's the setting you audit. Third, agent creation is an event. If a new scheduled agent can appear in your workspace without anyone noticing, you have no detection story for this class of attack at all.

We build automations that write to real systems, so we treat this as a permissions problem, not an AI problem: least privilege per connector, human approval on anything that sends, pays, or deletes, and a written list of what each agent can reach. It's unglamorous. It's also the entire defense.

Sources: Zenity Labs, The Register.