STORY RECORD
1-click ChatGPT agent hijack disclosed, fixed
Researcher Mike Takahashi (TakSec) of Zenity's AI red team disclosed AgentForger, a cross-site request forgery vulnerability in OpenAI's ChatGPT Workspace Agents.
A single phishing link could silently create, authorize, and deploy a persistent attacker-controlled AI agent inside a victim's organization — connecting to enterprise apps, disabling approval prompts, scheduling hourly execution, and taking commands from the victim's own mailbox.
OpenAI fixed the issue within four days after a Bugcrowd report. The Hacker News article confirms the technical details and notes OpenAI is deprecating the Agent Builder interface on November 30, 2026.
Why It Matters
This is the first public disclosure of a cross-site agent forgery attack against a major AI workspace platform.
Unlike prompt injection or data poisoning, AgentForger exploits the agent-provisioning pipeline itself — the architectural layer where agents are created, authorized, and connected to enterprise apps.
It turns a link an employee clicks into a persistent malicious insider inside ChatGPT Workspace. The four-day fix is fast, but organizations running ChatGPT Workspace Agents had no warning before this disclosure.
This joins a growing pattern: Agent Data Injection, tool-output prompt injection, MCP tool-description attacks — the agent's provisioning pipeline is emerging as a new attack surface, and defenses are still catching up.
The Facts
8The vulnerability, named AgentForger, is a cross-site request forgery (CSRF) that allows an attacker to forge an autonomous AI agent inside a victim's organization via a single phishing link.
strong · confidence 0.85
The attack works because ChatGPT's Agent Builder accepts an initialization state through URL parameters, including an agent template and a prompt. The value of initial_assistant_prompt is automatically submitted and executed when the page loads, without requiring further user interaction.
strong · confidence 0.8
The attack chain: click link → creates agent → connects enterprise apps via existing OAuth connectors → removes approval prompts → enables email-based command-and-control → adds persistence through hourly scheduling → conducts reconnaissance, data theft, and impersonation.
strong · confidence 0.8
The forged agent uses Preview Mode which is not a visual dry run — it executes the newly created agent against the victim's connected accounts using the configured approval settings.
strong · confidence 0.78
Once published and scheduled, the attacker can send new commands to the agent through the victim's mailbox. Each TASK email becomes a new assignment for the agent.
strong · confidence 0.78
The vulnerability was disclosed by Mike Takahashi (TakSec), AI Red Team Researcher at Zenity Labs, through Bugcrowd. OpenAI fixed it within four days.
strong · confidence 0.85
OpenAI has addressed the issue and is also deprecating the Agent Builder product effective November 30, 2026, urging users to switch to the Agents SDK.
moderate · confidence 0.75
The article was published by The Hacker News, a cybersecurity news outlet with 1.88 million followers on X.
strong · confidence 0.9