<- ALL CYBER NEWS
High
AI security, ChatGPT, AgentForger, OpenAI, workspace agents, phishing, prompt injection
ChatGPT AgentForger: One Link Deploys Rogue AI Agents
ChatGPT AgentForger let one phishing link stealthily deploy rogue workspace agents with access to a victim's connected tools. No malware, no CVE.
AgentForger is a critical flaw in OpenAI's ChatGPT Workspace Agents that let a single phishing link stealthily deploy rogue, persistent agents inside a victim's workspace - with access to the tools that workspace had already connected. There is no malware and no CVE; the victim only had to click a link.
What happened. Researchers disclosed AgentForger, a vulnerability in OpenAI's ChatGPT Workspace Agents. A single crafted link could ride a victim's active session to create rogue autonomous agents inside their ChatGPT workspace, bypassing the normal consent screens. Those planted agents inherit access to whatever the workspace was already authorised to use - the connected productivity and collaboration tools - and persist as quiet insiders.
How is AgentForger different from ordinary phishing?
Classic phishing steals a credential. AgentForger installs an actor. Instead of harvesting a password, one click plants an autonomous agent that keeps operating with the victim's pre-authorised tool access - no ongoing attacker interaction, no malware on any endpoint.
Who is affected?
Detail | Value |
|---|---|
Product | OpenAI ChatGPT Workspace Agents |
Trigger | A single phishing link (session hijack) |
Result | Persistent rogue agents with pre-authorised tool access |
Malware | None |
CVE | None - platform vulnerability, fixed by the vendor |
Who is affected. Any organisation using ChatGPT Workspace Agents wired into business tools. The blast radius is defined by how much access those agents were granted - which, for convenience, is usually a lot.
What should you do now?
Audit which AI agents exist in your workspaces and what each one can access - most teams cannot currently list this.
Enforce least privilege and per-action consent for agent tool access, not blanket pre-authorisation.
Treat "an agent exists" as a state worth monitoring, and alert on agents created outside your expected flow.
Our read. AgentForger is the attack class vulnerability scanning structurally cannot find: no CVE to match, no binary to flag - just a legitimate platform feature turned into a persistence mechanism by one click. You do not find this by scanning; you find it by simulating an adversary who plants the agent and watching what it can then reach. Seeing your AI agents is not enough - you have to test what they are actually allowed to do. That is supervised adversary simulation, and the agent layer now demands it.
Reporting by The Hacker News. Source linked above.
Related: Claude for Chrome extension flaw and agent data injection hijacks AI agents.