One phishing link built a ChatGPT agent with a real employee's access, and told it to stop asking permission

In June 2026, the AI security firm Zenity Labs discovered that Workspace Agents, a feature inside OpenAI's ChatGPT, could be built, configured and published entirely from a single link, requiring nothing from the victim beyond the initial click. The researchers reported the flaw, codenamed AgentForger, to OpenAI through its Bugcrowd disclosure programme on 4 June 2026. OpenAI fixed it four days later, on 8 June. Zenity published the full technical detail on 23 July 2026, and it stands as one of the clearest demonstrations yet of what happens when an execution boundary that was supposed to require a human simply is not there.

Workspace Agents connect to Outlook, Gmail, Slack, Google Drive, SharePoint and Teams, and are normally built through a conversational builder: a user types out what they want, chooses a template, approves which tools the agent can use, and decides whether its actions need confirmation. Zenity found the builder would also accept that entire configuration through two URL parameters, template_name and initial_assistant_prompt, and that the second of these was not simply dropped into a text box for review. It was submitted and executed automatically the moment the page loaded.

An attacker only needed a link shaped like https://www.google.com/url?q=http://chatgpt.com/agents/studio/new&source=gmail&ust=1785129754267000&sa=E, with a template and a prompt attached, sent to any employee already logged into ChatGPT with at least one connected app. One click opened the builder inside that employee's own authenticated session and ran the embedded prompt, which built an agent named "Chief of Staff," attached every connector the employee had previously approved, switched each one from "Always ask" to "Never ask" for read, write and delete actions, published the agent live, scheduled it to run every five minutes, and triggered an immediate first run through Preview Mode, which Zenity found executed against the real connected accounts rather than a sandbox. None of it needed a new consent screen, because the connectors were already trusted from the employee's prior use.

In testing, the researchers used the same inbox the agent was watching to issue it instructions, each one disguised as a routine email with a subject beginning "TASK." The forged agent mapped the organisation's people, projects and Slack channels, searched Drive, SharePoint and Outlook for sensitive files including an M&A term sheet and a board presentation flagging a revenue miss, scanned Slack for messages containing the word "pass:" and returned plaintext credentials, sent an internal Teams message under the employee's own name directing colleagues to a fake Microsoft login page, and prepared an approval request to wire $242,500 to an external account. It did all of this without a further click from the person whose identity it was using, on a schedule that kept it running long after the original email had been forgotten.

The approval gate that was supposed to stop exactly this kind of action was not weak by conventional standards. "Always ask" is the default specifically because a write action inside a connected mailbox or Slack workspace is meant to require a human to confirm it in the moment. The problem was that the same natural-language instruction that built the agent was also trusted to turn that gate off, and the platform had no separate, out-of-band step confirming that whoever had just switched approvals to "Never ask" was a person at all, let alone the right one. Once the setting changed, everything downstream executed on the agent's own authority.

Publishing an agent, changing its approval policy from "ask" to "never ask," and authorising a wire transfer are each execution events in their own right, not configuration details to be waved through because a plausible-looking prompt asked for them. Before any of those actions can take effect, GoFirm sends a real-time push notification to the named authority, the actual employee whose session is being used, or the finance approver whose sign-off a wire requires, on their own registered device, over a channel the ChatGPT session itself has no way to reach.

If no biometric confirmation arrives, the action is blocked at the boundary: the connector stays on "always ask," the agent never goes live, the wire is never approved. It makes no difference that the request arrived instantly, that it used the employee's own credentials, or that the agent could write a perfectly convincing internal message in the employee's voice. A forged agent, however deep its access or however convincing its impersonation of the employee it hijacked, cannot produce a biometric confirmation on that employee's own registered device through a separate channel. The execution boundary holds regardless of whether the thing asking for permission is a person, an autonomous agent, or a URL parameter pretending to be both.

GoFirm is The Authority Platform. Stop unauthorised action. Every time.

In association with Osinto.ai, the collective intelligence platform for Security, Resilience & Defence. Osinto's AI-enabled open-source network and governed collaborative operational environment help mitigate the growing security, resilience and governance obligation in seconds, not days.

References

1. Takahashi, M. 2026. AgentForger, Part 1: ChatGPT Cross-Site Agent Forgery. Zenity Labs, 23 July 2026.

2. Takahashi, M. 2026. AgentForger, Part 2: The Autonomous Insider. Zenity Labs, 23 July 2026.

3. Lakshmanan, R. 2026. ChatGPT AgentForger flaw could deploy rogue Workspace Agents via a phishing link. The Hacker News, 24 July 2026.