Phishing Link Plants a Rogue ChatGPT “Insider”

How the attack worked

Researchers at Zenity Labs identified a flaw, referred to as AgentForger, in which a single click on what looked like an ordinary ChatGPT link could cause ChatGPT's agent builder to create and publish a malicious workspace agent on the attacker's behalf. The link carried embedded instructions that the agent builder accepted without requiring further input from the victim. Once built, the agent could wire itself into the victim's existing connectors, turn off approval prompts, publish itself, and run on a schedule, giving it persistence well beyond the original phishing email.

Why it succeeded

The technique did not rely on stealing passwords or browser sessions. Instead, it tricked ChatGPT into building an autonomous assistant that could act through the employee's own connected accounts and permissions, including Outlook, Teams, Slack, SharePoint, or Google Drive. Because the agent operated with the victim's real access, its actions looked like legitimate employee activity rather than an external intrusion. The attack also depended on the victim belonging to a workspace where agents were enabled and where they had permission to create them, conditions that are increasingly common as organizations adopt AI productivity tools.

What to watch for

Once active, the rogue agent could be controlled without traditional malware infrastructure. It simply checked the victim's inbox for attacker emails with "TASK" in the subject line, treating each one as a new assignment such as searching company files, collecting sensitive documents, or sending results back by email. The researchers also demonstrated that the agent could send convincing phishing messages through the victim's own Teams account, effectively impersonating the employee to coworkers. Warning signs include unexpected agent creation links, generic command-like email subjects, and outbound messages or file activity that the account owner did not initiate.

How to build resistance

• Treat unexpected links to create or configure AI agents as suspicious, even when they appear to come from a trusted productivity tool.
• Recognize that connecting AI agents to email, chat, and file storage expands the potential impact of any single compromised link.
• Train staff to notice insider-like abuse signals, such as messages or file access they did not initiate, rather than focusing only on stolen credentials.
• Restrict who can create and publish workspace agents, and require approval prompts for sensitive actions rather than allowing them to be disabled automatically.
• Encourage employees to verify unexpected setup or configuration requests before clicking, especially those tied to AI tools with broad connected permissions.

How could a ChatGPT link create a malicious agent?

Researchers at Zenity Labs found that a ChatGPT link could carry embedded instructions that caused the agent builder to create and publish a new workspace agent after a single click, without further action from the victim.

What could the rogue agent actually do?

Once published, the agent could inherit the victim's connected app permissions, such as Outlook, Teams, Slack, SharePoint, or Google Drive, and use them to search files, send messages as the employee, and collect sensitive documents.

How did the attacker control the agent after the initial click?

Instead of typical command-and-control infrastructure, the agent polled the victim's inbox for emails from the attacker with 'TASK' in the subject line and treated each one as a new assignment.

Was this vulnerability fixed?

Yes, the article states OpenAI reportedly fixed the issue quickly by removing the URL parameter that enabled the attack.