Technology news and discussion on TalkFuse.
One ChatGPT link could smuggle a rogue AI agent into your company
Security researchers at Zenity Labs have disclosed a flaw in OpenAI's ChatGPT workspace agent builder that could let an attacker plant a malicious, autonomous AI agent inside a victim's corporate ChatGPT account via a single malicious link. Dubbed "AgentForger," the technique tricked ChatGPT into silently creating, configuring, publishing and scheduling an agent that could act through the victim's existing connected accounts and permissions, rather than relying on stolen passwords or session tokens. Because the rogue agent inherited the employee's genuine access to tools such as Outlook, Teams, Slack, SharePoint or Google Drive, researchers say it effectively became a "forged insider" capable of operating long after the initial phishing email had been dealt with.
In proof-of-concept tests, the agent monitored the victim's inbox for emails containing "TASK" in the subject line, treating each as a new instruction to search files, gather sensitive documents or send data back to the attacker by email. Demonstrated capabilities included mapping an organisation's staff and projects, hunting for passwords and API keys in chat histories, and sending convincing phishing messages from the victim's own Teams account. Zenity reported the issue to OpenAI via Bugcrowd on 4 June; OpenAI acknowledged it the next day and patched the flaw four days later by removing the URL parameter that enabled the attack, before any public disclosure.
In short
- Flaw let a single ChatGPT link install a rogue AI agent
- Agent used victims' real access to Outlook, Slack, Teams, Drive
- OpenAI fixed the bug within days of Zenity's report
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Security professionals and enterprises must understand emerging attack vectors to build effective defences. Publishing details of patched vulnerabilities educates organisations about risks they may encounter on other platforms or systems, enabling them to audit their own configurations for similar weaknesses. The swift patch—four days from report to fix—neutralises the immediate threat window, so transparency now serves the broader defensive purpose without enabling attacks on unpatched systems.
The case against
Publishing detailed attack methodologies risks enabling copycat attacks on other AI platforms, incompletely patched systems, or similar yet-undiscovered vulnerabilities. The responsible disclosure process worked perfectly, with OpenAI fixing the flaw in four days without any exploitation occurring. Further publicity creates a blueprint for attackers and serves no remaining defensive benefit since the vulnerability is already remediated. Professional security practice favours discretion about patched vulnerabilities.
Explained simply
ChatGPT has a feature that lets companies set up customised AI agents within their accounts. These agents can be connected to workplace tools like email, messaging apps and file storage, giving them the ability to perform tasks through those systems just as an employee would.
Security researchers have discovered a serious flaw in how these agents are created. An attacker could send a single malicious link to an employee; if that employee clicks it, a hidden agent could be secretly planted into the company's ChatGPT account. This rogue agent would then inherit all the employee's access permissions to their workplace tools.
Once inside, such an agent could operate like a spy embedded within the organisation. It could read emails, search files, gather sensitive information, send messages impersonating the employee, and transmit stolen data back to the attacker. Because it uses the employee's genuine access, it would be extremely difficult to detect and could continue operating long after the initial attack was discovered.
AI Americas Business Companies Cybersecurity Research Science Technology World