AgentForger: One Phishing Link Plants an Attacker-Controlled AI Agent Inside Your Enterprise

AgentForger exploits the way ChatGPT's Agent Builder processes two URL query parameters: template_name selects the starting agent template, and initial_assistant_prompt injects an attacker-controlled system prompt that the Builder executes automatically the moment the page loads -- with no confirmation required from the user.

The attack works because the Agent Builder was designed to accept initialization state through URL parameters to support sharing and template distribution workflows. When a victim who is logged into ChatGPT Enterprise with Workspace Agents access clicks a weaponized link, the page loads with the malicious prompt pre-populated and auto-submits it. The attacker's instructions configure the agent to attach all existing authorized connectors with "Never ask" approval settings, publish the agent, and schedule it to run every five minutes via offset scheduling. The entire setup completes without any additional interaction from the victim.

Critically, no new OAuth authorization screens appear during agent creation. The forged agent inherits the victim's pre-existing connector authorizations: any integration the employee previously granted ChatGPT access to -- Outlook, Gmail, Slack, Teams, SharePoint, Google Drive -- becomes immediately available to the forged agent. The attacker gains access to all of these enterprise services under the victim's identity, without ever compromising a password, bypassing MFA, or triggering an Identity Protection alert.

Once deployed, the forged agent monitors the victim's Outlook inbox for emails from the attacker's address with subjects beginning "TASK." Each task email contains instructions the agent executes against connected services, then returns results directly to the attacker's email. The agent runs on a schedule indefinitely. As Zenity Labs researchers noted: "The forged agent becomes a persistent operator. The original click installs it; the schedule keeps it alive."

Any organization using ChatGPT Enterprise with the Workspace Agents feature enabled is within the scope of the AgentForger attack class. The specific URL parameter flaw was patched by OpenAI on June 8, 2026 -- but the broader exposure persists because the attack's underlying conditions remain widespread across enterprise AI deployments.

Three conditions must be present for the attack to succeed: the employee must be logged into ChatGPT; they must have Workspace Agents access; and they must have at least one enterprise connector already authorized. All three conditions are standard in any meaningful ChatGPT Enterprise deployment. Outlook, Teams, and SharePoint are the most common connector authorizations for enterprise users, making the forged agent's access to Microsoft 365 data the highest-probability outcome in a successful attack.

OpenAI began deprecating the Agent Builder feature with full sunset scheduled for November 30, 2026. Organizations that have not reviewed their Workspace Agents activity during the AgentForger exposure window (June 4 to November 30, 2026) carry unresolved risk: a forged agent created before the patch, or created via a variant technique, may still be operating inside the workspace.

The broader risk extends to any enterprise AI platform that accepts user-facing configuration inputs without mandatory explicit confirmation at each step. Zenity Labs researchers classify AgentForger as the first documented "Cross-Site Agent Forgery" (CSAF) attack -- a new category analogous to CSRF but designed specifically for the autonomous action capabilities that AI agents introduce. For related context on how attackers exploit the AI coding agent attack surface, see our investigation of AgentJacking via MCP injection.

Once the forged agent is live, the attacker holds an operator-level capability inside the victim's organization. The agent runs on the victim's identity, uses the victim's authorized connector access, and operates through legitimate ChatGPT infrastructure. Standard enterprise detection tools -- SIEM, EDR, CASB, Identity Protection -- see only authorized ChatGPT activity from a valid user session. Nothing alerts.

The capabilities the forged agent can execute depend on which connectors the victim had pre-authorized. With Outlook access: the agent reads all email, forwards sensitive correspondence to the attacker, and sends internal phishing messages impersonating the victim to colleagues and finance teams. With SharePoint access: the agent reads and downloads documents, project files, and credentials stored in SharePoint sites and Teams channels. With Slack access: the agent harvests tokens, reads direct messages, and exfiltrates channel history including any secrets shared in chat. With Gmail and Google Drive access: the same document and communication compromise extends to Google Workspace environments.

The command channel -- TASK-prefixed emails from the attacker's inbox to the victim's Outlook -- gives the attacker interactive control at any time. The attacker can update instructions to direct the agent to new targets, pivot between connectors, exfiltrate specific documents, or initiate business email compromise sequences impersonating the employee to external partners and vendors.

Zenity Labs researchers documented the detection evasion directly: "At its core, AgentForger is an agent trust failure: the platform trusts that the user intentionally created, approved, scheduled, and operated the agent." Every platform-level log entry records the forged agent's activity as legitimate user-initiated behavior. For related context on how LLM-based tools are turned against Active Directory environments, see our reporting on LLM-powered AD attacks.

No CVE-specific Sigma rule exists for AgentForger -- no CVE was assigned, and the vulnerability was patched before community rules were written. Two community rules cover the most likely downstream behavioral signals: unusual OAuth-driven file downloads from SharePoint (the most common data exfiltration action a forged agent would take) and outbound requests to OAuth phishing infrastructure used in AI agent attack delivery campaigns.

Both rules target cloud telemetry, not endpoint logs. The first rule targets Microsoft Defender for Cloud Apps threat management logs, which record anomalous OAuth application file access patterns across Microsoft 365. The second targets outbound web proxy logs and covers PhaaS kit infrastructure that adversaries use to stage phishing delivery.

The WAF rules below are outbound proxy and CASB detection rules, not traditional reverse proxy protections. AgentForger executes via the victim's browser against chatgpt.com -- standard inbound WAF deployments protecting your own web applications will not see this attack. Deploy the rules below in Cloudflare Gateway, Zscaler Internet Access, Netskope, or any Secure Web Gateway configured to inspect outbound HTTPS traffic to detect the specific URL pattern that delivers the forged agent creation request.

Detecting AgentForger-style attacks requires reviewing ChatGPT Enterprise audit logs directly -- no external telemetry source captures agent creation events by default. Navigate to your ChatGPT Enterprise admin console, open the audit log section, and filter for agent creation events between June 4 and November 30, 2026. Any agent created without a corresponding internal ticket, change request, or user acknowledgment warrants immediate review.

Four behavioral indicators distinguish a forged agent from a legitimately created one. First, check connector permission settings: a forged agent configures all available connectors with "Never ask" approval level. Legitimate agents created by users for their own automation workflows rarely disable all approval prompts simultaneously. Second, check scheduling: forged agents use recurring execution schedules with short offsets rather than manual trigger or event-based trigger configurations. Third, review the agent's instruction set for references to external email addresses in a command-and-control pattern -- legitimate agents do not poll an external inbox for operational instructions. Fourth, examine outbound email activity and SharePoint download volume from the agent's associated user account for unexpected spikes.

Microsoft Defender for Cloud Apps (MDCA) anomaly detection will alert on the data exfiltration phase if volume thresholds are crossed. The "Suspicious OAuth app file download activities" alert covers the SharePoint mass download scenario. Routing MDCA threat management alerts into your SIEM and correlating them with ChatGPT Enterprise audit log events for the same user account provides the highest-confidence detection chain available for this attack class.

The specific AgentForger URL parameter flaw is patched. OpenAI removed the injectable initial_assistant_prompt parameter on June 8, 2026, and the Agent Builder feature reaches full deprecation on November 30, 2026. Neither fact eliminates the underlying risk -- the same trust failure exists in other enterprise AI platforms deploying today.

Organizations still using ChatGPT Enterprise with Workspace Agents should disable the feature for all users without active, documented agent deployments. Every authorized connector attached to an unused or unreviewed agent is an attack surface producing no business value. For organizations that do require AI agent capabilities, establish a formal AI agent governance process before deploying any autonomous agent in production: every agent requires a ticket, a named owner, an approved connector list, and a data access justification. Agents must run under service accounts with scoped permissions -- not individual employee accounts with full inbox and SharePoint access. Approval gates must stay enabled for all connector actions involving email, document access, or external communication.

The governance model matters because the same structural conditions that made AgentForger exploitable -- autonomous agents authorized to act on employee identities, with inherited connector access, without per-action review -- exist across the enterprise AI ecosystem. Any future CSAF technique targeting a different AI platform will find the same unguarded trust boundary unless organizations build explicit governance around autonomous agent authorization before the next disclosure arrives.

AgentForger demonstrates that the enterprise AI adoption wave has outpaced the security control frameworks designed to govern it. Every organization deploying AI agents is authorizing autonomous systems to act on employee identities, use employee connector access, and make decisions without per-action human review. AgentForger showed that a single misconfigured trust boundary -- URL parameters accepted as executable instructions without verification -- is enough to convert that entire authorization chain into an attacker-controlled capability inside the organization.

The attack class AgentForger defines, Cross-Site Agent Forgery (CSAF), is not bounded by ChatGPT. Any enterprise AI platform that accepts initialization state through user-facing inputs, inherits connector authorizations from authenticated user sessions, and runs autonomously on schedules without per-action approval shares the same structural vulnerability. The specific delivery mechanism changes with each new AI product. The underlying trust failure does not.

Prior enterprise AI security concerns focused on employees misusing AI tools or AI generating incorrect outputs. AgentForger shifts the threat model: the AI tool itself becomes the threat actor, operating autonomously inside the organization's trust boundary at the attacker's direction, using credentials and access the organization explicitly granted. Existing security stacks -- SIEM, EDR, CASB, IDP, network monitoring -- were not built to detect this pattern. The signals exist in vendor audit logs that most organizations do not route into their SIEM, let alone alert on.

Security teams that want to get ahead of AI agent threats should route ChatGPT Enterprise audit logs into their SIEM today, establish AI agent governance policies before the next deployment, and track AI-specific security research from groups like Zenity Labs monitoring the CSAF attack class as it evolves across the enterprise AI ecosystem.