AI 安全
AgentForger Uses URL Parameters to Forge ChatGPT Workspace Agents and Inherit Users’ Existing Connector Permissions
Zenity has disclosed a patched CSRF-style attack chain: merely opening a crafted link while logged in could cause ChatGPT Agent Builder to automatically create, schedule, and run an attacker-controlled agent. The vulnerability did not bypass OAuth; instead, it inherited existing authorizations, highlighting a new trust gap among agent creation workflows, execution identities, and tool permissions.
Zenity Labs has disclosed a vulnerability in ChatGPT Workspace Agents named AgentForger. The issue stemmed from the Agent Builder creation page accepting URL parameters such as `template_name` and `initial_assistant_prompt`, with the prompt parameter capable of being submitted automatically after the page loaded. An attacker could therefore disguise a crafted link as an ordinary ChatGPT URL. If a logged-in user with Workspace Agents access who had previously authorized enterprise connectors opened it, the system could create and publish a predefined attacker-controlled agent on the user’s behalf.
In the researchers’ demonstration, the agent changed the approval mode to “Never ask,” configured recurring tasks, and received follow-up instructions through Outlook email. Because connectors such as Gmail, Outlook, Slack, Teams, Drive, or SharePoint had already been authorized by the victim, the attack chain did not need to trigger another OAuth consent screen. The agent could search across systems for documents and credentials, exfiltrate data, and even send internal phishing messages as the victim. This represents an amplification of traditional CSRF through agentic systems: what is forged is no longer a single request, but a persistent work identity capable of operating across tools.
Zenity said it reported the issue in early June and that OpenAI deployed a fix within days. There is currently no evidence that the vulnerability was exploited in the wild. Public disclosures also do not include a CVE, complete details of the server-side remediation, or the scope of affected tenants, so they do not establish that every Agent Builder deployment was vulnerable.
Engineering teams should look beyond prompt injection alone. Agent creation, publishing, scheduling, connector attachment, and changes to approval policies should all be treated as auditable events. High-privilege connectors should use per-agent authorization rather than automatically inheriting all of a user’s permissions. Key questions for platforms include whether they can provide tenant-level agent inventories, creation provenance, immutable minimum approval requirements, and real-time alerts for new agents and scheduling changes.