Experts warn ChatGPT’s Workspace Agent Builder can be hijacked to create malicious AI workers

Zenity Labs found AgentForger, a bug in OpenAI’s ChatGPT Agent Builder
Malicious links can instantly deploy rogue agents that exfiltrate sensitive data without user notification
OpenAI fixed the problem by removing the dodgy URL parameter; no abuse detected

AI agents are handy for answering customer emails or tracking reports for newly released security vulnerabilities. But what if they become unscrupulous and turn on the company they are supposed to support?

Security researchers from Zenity Labs have found a way for cybercriminals to trick people into inserting such agents into their own tech stack. Since all it takes is a single click, the disruptive potential of these attacks is arguably significantly greater than anything a phishing attack could do.

The flaw was discovered in OpenAI’s ChatGPT Agent Builder, a feature that lets users create custom AI agents. The researchers called it “AgentForger” and explain that the problem stems from an overly permissive parameter in the tool, which allowed anyone to create ChatGPT links containing virtually any instructions.

Agent trust failure

As soon as the victim clicks on the link, they send the instructions to Agent Builder, which responds to them immediately – without asking or otherwise notifying the victim.

In theory, a single phishing email could trick someone into deploying a malicious agent that exfiltrates sensitive data or does anything else that enterprise AI agents are allowed to do. To make matters worse, the AI agent would persist on the infrastructure indefinitely, doing the attackers’ bidding until caught.

“This is an agent trust flaw, and existing security controls were never built to see it,” commented Michael Bargury, co-founder and CTO of Zenity.

The researchers revealed their findings with OpenAI in early June 2026, and the company came back with a correction a few days later.

The bug was fixed by removing the URL parameter that initially enabled the attack, it explained. There is no evidence that it has been discovered or abused by malicious actors in the past.