One-Click Phish Could Spawn a Hidden AI Insider

How the attack worked

The flaw, disclosed by Zenity Labs and referred to as AgentForger, targeted ChatGPT Workspace Agents. It relied on getting a logged-in employee to click a single weaponized initialization URL. That link carried parameters selecting a powerful agent template and injecting instructions through an over-permissive prompt parameter, effectively standing up an autonomous agent the victim never intended to create.

Once active, the agent could be remotely controlled by the attacker through ordinary email. Messages with subjects starting with "TASK" were treated as commands. The agent would process these instructions using whatever apps were already connected to the victim's account and email the results back out, all without further interaction from the employee.

Why it succeeded

The attack depended on a narrow but realistic set of conditions: the victim had to be logged into ChatGPT, have access to Workspace Agents, and already have at least one authorized connector such as Gmail or Outlook. Because that connector was already authorized, creating the new agent did not trigger a fresh OAuth consent screen, removing one of the usual visual cues that something unusual was happening.

This meant the entire compromise hinged on one social engineering moment: getting the employee to click the setup link. After that, the agent operated inside the organization's existing trust boundary, using tools the employee had already approved.

What to watch for

• Unexpected requests to click a setup or initialization link for an AI agent or workflow you didn't ask for
• Emails with subject lines starting with "TASK" that appear to trigger automated actions
• Requests, automated or otherwise, to send unredacted or "raw" data externally
• Any AI tool or agent unexpectedly acting on connected email or business apps without a clear business justification

Building resistance

Organizations using ChatGPT Workspace Agents or similar tools connected to email and business apps should treat agent setup links with the same caution as credential phishing links, verifying unexpected requests through a trusted channel before clicking. Security awareness training should expand beyond classic credential theft to cover the idea of a "forged insider," an automated agent granted trust and access without the usual signs of compromise. Teams should also watch for automation that requests unredacted data be sent externally, since this is a strong signal of data exfiltration regardless of whether a human or an AI agent is performing the action.

This attack technique aligns with phishing and social engineering methods described in MITRE ATT&CK, including spearphishing links and user execution via malicious links.

What is the AgentForger vulnerability?

AgentForger is a flaw disclosed by Zenity Labs in ChatGPT Workspace Agents that could let an attacker trick a logged-in employee into launching an invisible, attacker-controlled autonomous agent with a single phishing click.

Does the attack require a new login or consent screen?

No. If the victim already has an authorized connector such as Gmail or Outlook, the agent can be created without triggering a new OAuth consent screen, making the activity harder to notice.

How does the attacker control the hidden agent afterward?

The attacker sends emails with subjects starting with "TASK," which the agent treats as commands, then uses connected apps to carry out the instructions and email results back to the attacker.

Was this issue fixed?

Yes. Zenity reported the issue on June 4 and OpenAI fixed it by June 8.