AgentForger Turned One ChatGPT Link Into a Scheduled Autonomous Insider
Zenity validated that one crafted ChatGPT link could drive Workspace Agents, OpenAI's enterprise agent builder, inside a logged-in victim session. The builder created and published an attacker-instructed agent, attached previously authorized connectors, disabled approvals, and stacked recurring hourly schedules at five-minute offsets into an effective five-minute email command loop. OpenAI fixed the reported vulnerability on June 8, 2026. The case shows why agent control-plane changes, connector use, scheduled execution, and outbound data flows need separate authorization boundaries.
Permission BypassTool AuthorizationHuman-in-the-LoopAgentic AIEnterprise AI
The attacker needed one click and an eligible session. The victim had to be logged in, have Workspace Agents access, and have an authorized connector; one click was the only further interaction.
A legitimate template deep link crossed into the agent control plane. The URL selected chief-of-staff with template_name and supplied attacker instructions with initial_assistant_prompt; the builder automatically submitted them in the victim's session.
The builder created durable authority and two execution paths. It attached connectors, set Outlook to Never ask, published the agent, and staggered hourly schedules from :00 through :55 to run every five minutes. Preview ran it immediately without another approval.
Email became command and control. The scheduled agent read attacker TASK emails, executed them through connected apps, and emailed raw results back.
Zenity validated four impact paths. It demonstrated organization mapping, business-data and credential theft, and victim impersonation for phishing and fraud.
This was validated research, not a breach report. Zenity says OpenAI fixed it four days after the June 4 report; no public source claims exploitation in the wild.
Keep the conversational builder and every agent runtime unable to administer the controls that supervise them. Connector attachment, approval policy, publishing, schedules, audit routing, and kill switches need separately authorized control-plane identities and APIs. An attacker prompt should never be able to rewrite those settings.
Require a fresh, independently verified approval bound to the exact immutable change before attaching connectors, selecting Never ask, publishing an agent, adding a schedule, or sending external messages. A prior login or connector consent is not approval for a newly generated autonomous workflow.
Value-Level Capability Metadata & Data Flow Sink Enforcement
Very High
Label values returned from Outlook, Gmail, Slack, Teams, Drive, SharePoint, and calendar connectors by source and sensitivity. At the tool dispatcher, block sensitive values from being sent to unapproved external recipients, URLs, documents, or other write destinations, even when both the read connector and email tool are individually authorized.
A scheduled run must not inherit a stale builder decision. Re-check the signed task scope, connector grant, approval receipt, target resource, recipient, and current policy immediately before every sensitive action, and require fresh authorization after each scheduled pause, resume, retry, or worker handoff.
Derive the smallest signed tool set and action budget from a trusted, user-visible task. Clicking a link must not produce a scope that includes every existing connector, cross-app searches, external email, messaging, calendar writes, and recurring execution. Enforce the scope at the dispatcher, not only in builder configuration.
The stack of recurring hourly schedules staggered across :00, :05, :10, and so on through :55 is a stronger signal than a single five-minute schedule. Correlate that schedule pattern with mailbox reads, TASK-like command envelopes, repeated cross-app activity, and outbound replies to detect a SaaS AI agent being used for command and control. Findings still require investigation and containment.
Compromised Durable Application Session & Agent State Teardown
High
After identifying a forged agent, remove its exact durable agent record, recurring schedules, queued jobs, tool registrations, and tainted state. Verify through a separate read-only path that no schedule or stored instruction can reload the attacker workflow. Active runs need separate runtime termination.
Delegated Grant & Connected-App Authorization Revocation
High
Revoke the exact OAuth grants, connected-app consents, and delegated authorizations that sustained the forged agent's access. Re-enumerate every applicable provider after propagation and prove the targeted grants can no longer mint tokens or access resources while approved non-target grants remain intact.
Independently correlate every observed high-risk agent change and execution with its signed approval record, authenticated approver, exact action digest, nonce, policy version, and complete human-in-the-loop lifecycle. Alert when selecting Never ask, publishing the agent, or running scheduled connected-app actions has missing, invalid, expired, mismatched, replayed, or unattended approval evidence. This detector complements the preventive approval gate; it does not authorize the action.
What Defenders Should Do Now
Confirm the provider fix in an isolated test workspace: opening a crafted builder link must not create, configure, publish, schedule, or run an agent before an explicit user-reviewed action.
Restrict agent building, publishing, and agent-owned or personal connector use to narrowly scoped roles. Audit who can attach sensitive connectors and who can publish scheduled agents.
Keep risky write actions on Always ask or an equivalent high-impact approval mode. Do not let agent-generated instructions change approval policy or schedules without fresh independent authorization.
Constrain each connector to required actions, resources, and recipients. Pair those constraints with value-level data-flow controls because action constraints do not by themselves restrict every value a connector may return.
First inventory which fields your plan actually exposes through Workspace Agents administration or analytics, the OpenAI Compliance Platform, and each connected provider's audit logs; treat unavailable per-action evidence as a visibility gap. Where evidence exists, alert on new agents with broad connectors, Never ask settings, stacks of hourly schedules staggered at five-minute offsets, mailbox polling, cross-app fan-out, and outbound messages to newly observed external recipients.
If compromise is suspected, stop active runs, unpublish the agent, cancel schedules, preserve configuration and activity evidence, remove durable state, revoke connected-app grants, and review mail, chat, files, and calendar actions for secondary impact.
1 additional consideration
Cross-site request integrity for agent builders
Beyond the AIDEFEND controls mapped above, the provider must also apply conventional web protections at the builder entry point. State-changing initialization must not be accepted from attacker-controlled query parameters in an authenticated browser session.
Recommendation: Use anti-CSRF tokens, strict Origin and Referer checks, appropriate SameSite cookies, non-idempotent POST requests, and explicit review before any generated configuration is saved or executed. Reproduce the published crafted-link path in an isolated regression environment and require zero agent, connector, approval, schedule, publish, or Preview state changes.
Conclusion
AgentForger joined a web request flaw to an AI control plane that could create identity-bearing, scheduled automation. The provider-side fix closes the reported entry path, while enterprise controls determine whether one builder session can still accumulate broad connectors, suppress approvals, persist, and export data. Strong deployments therefore separate control-plane authority, reauthorize every high-risk execution, enforce where sensitive values may be sent, and maintain a tested teardown path for forged agents.