A security research team has demonstrated a novel class of attack against AI-powered workplace tools: a single ChatGPT link that, when clicked by an employee, silently creates a fully autonomous malicious agent inside the company’s ChatGPT workspace, equipped with the victim’s identity, access permissions, and connected application credentials.
The vulnerability, tracked as AgentForger and disclosed publicly on July 23, was reported to OpenAI on June 4 through its Bugcrowd program and patched the following day. OpenAI removed the URL parameter that enabled the attack within 24 hours of receiving the report, though the underlying class of vulnerability, what researchers call an agent trust failure, remains an open security problem for the industry.
How the attack works
The exploit chain begins with a phishing email containing a link that appears to be an ordinary ChatGPT URL. The link, however, contains embedded instructions that the ChatGPT agent builder interprets as a configuration command. With one click, the builder creates a workspace agent configured with the victim’s existing permissions and application connectors.
The newly created agent does not need to phone home to a command-and-control server. Instead, it monitors the victim’s email inbox for messages from the attacker containing the word “TASK” in the subject line. Each such email becomes a new assignment, search files, harvest credentials, exfiltrate documents, executed through the victim’s connected Outlook, Teams, Slack, SharePoint, or Google Drive accounts.
The attack has several prerequisites. The victim must belong to a ChatGPT workspace where agent creation is enabled, must have permission to create agents, and the organization’s administrators must have allowed connections to external applications. In practice, these conditions describe a growing number of enterprises deploying AI agents as productivity tools.
Proof-of-concept scenarios
The research team demonstrated three categories of attack achievable through AgentForger. The first was corporate data trawling: the agent systematically mapped an organization’s people, projects, and communications by searching across email, chat, calendars, and file stores. The second was credential hunting: the agent searched message histories for embedded passwords and API keys. The third was insider phishing: the agent sent convincing messages through the victim’s own Teams or email account, using their identity to trick colleagues into revealing sensitive information.
The common thread across all three scenarios is that the agent operates under an identity the organization trusts, making its actions indistinguishable from legitimate employee behavior. Traditional security controls, firewalls, endpoint detection, network monitoring, were not designed to distinguish between a human employee accessing files and an AI agent doing the same thing under that employee’s credentials.
Timeline and response
OpenAI acknowledged the report on June 5, 2026, and deployed a fix by June 9 that removed the vulnerable URL parameter. The public disclosure on July 23 follows the standard 30-to-45-day coordinated disclosure window. The company did not respond to press inquiries about whether it had detected any exploitation of the vulnerability in the wild before the fix.
The broader significance of AgentForger extends beyond the specific ChatGPT vulnerability. As AI agents transition from answering questions to taking actions across corporate systems, reading files, sending messages, modifying data, the attack surface begins to resemble a workforce rather than traditional software. A compromised agent does not steal credentials to impersonate an employee; it is issued credentials by the employer and then turned against it.