OpenAI fixes ChatGPT agent flaw enabling remote hijack
This digest was compiled by AI from multiple sources — links to the originals are below.
OpenAI patched a critical vulnerability in ChatGPT Workspace Agents that could let attackers forge an autonomous insider agent via a single phishing link. The flaw, discovered by Zenity Labs, allowed remote control of the agent without victim awareness. The fix was deployed after responsible disclosure.
The Vulnerability
Zenity Labs disclosed a cross-site request forgery (CSRF) flaw in OpenAI's ChatGPT Workspace Agents, dubbed AgentForger. The bug resided in the Agent Builder's initialization URL, which accepted two over-permissive parameters: one specifying the agent template (e.g., Chief of Staff) and another (initial_assistant_prompt) providing instructions. An attacker could craft a URL that, when clicked by a logged-in victim with access to Workspace Agents and an authorized connector (Gmail, Outlook), would create a powerful agent with prespecified commands.
Attack Execution
The weaponized URL instructed the agent to check the victim's email for messages from the attacker with subject "TASK", process them using connected apps, and email results back without redaction. Additional commands hid the agent, disabled user approval prompts, and made it live. The agent's creation and external control remained invisible to the victim organization, as no new OAuth consent screen appeared due to the existing connector.
Security Implications
Michael Bargury, Zenity CTO, described the flaw as a "forged insider" — an agent trust failure where attackers no longer need to breach systems directly. Instead, they can remotely control a legitimate agent with the victim's identity and access. The attack required only a successful phish of an employee meeting specific preconditions. OpenAI has since deployed a fix.
What's Next
OpenAI is expected to release a detailed advisory on the patch. It remains unclear whether similar vulnerabilities exist in other agent-building platforms.
2 sources
OpenAI fixes ChatGPT agent flaw enabling remote hijack
