Disclosed vulnerability
AgentForger: one phishing link forges an attacker-controlled ChatGPT workspace agent with a victim's identity
AIR-2026-0170 AIR record · 2026-07-zenity-agentforger
From the supporting source
A single link could hijack OpenAI's ChatGPT Agent Builder to stand up an attacker-controlled AI agent with a real employee's access.zenity.io
The record
Disclosed
2026-07-23
Vendor
OpenAI
Product
ChatGPT Workspace Agents / Agent Builder
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation, Data exfiltration channels, Human manipulation
System type
Generative model
Who acted
Agent acted — the forged agent acted with the victim's identity and delegated OAuth
Attack surface
Enterprise assistant
Autonomy level
Fully autonomous
Initial vector
Malicious link csrf style
Impact type
Persistent unauthorized access, Data exfiltration, Credential theft, Internal phishing
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
ChatGPT enterprise workspaces using Agent Builder
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
OpenAI removed the over-permissive URL parameter within 4 days
Taxonomy & references
Curator notes
Disclosed to OpenAI via Bugcrowd 2026-06-04; acknowledged in 1 day, fixed in 4. Technical detail split across labs.zenity.io 'AgentForger, Part 1: ChatGPT Cross-Site Agent Forgery' and 'Part 2: The Autonomous Insider'. A dozen PoC scenarios; no known real-world abuse.
Supporting sources
Cite as
Enkrypt AI. "AgentForger: one phishing link forges an attacker-controlled ChatGPT workspace agent with a victim's identity". AIR, AIR-2026-0170. https://agentincident.vercel.app/i/AIR-2026-0170/ (accessed 2026-10-19).