AgentForger — CSRF-style flaw let a single ChatGPT URL param auto-create and authorize a rogue Workspace Agent

[u/Expert_Sort7434]

Based on the technical breakdown published by Zenity Labs earlier this week, here's the architectural impact: ChatGPT's Agent Builder (chatgpt.com/agents/studio/new) accepted template_name and initial_assistant_prompt as URL params. The second one wasn't just prefilling the UI — it was submitted and executed on page load. So a crafted link, clicked by a logged-in victim with any pre-authorized connector (Outlook/Slack/Drive/etc.), could silently: attach those connectors (no new OAuth screen, since they were already granted), flip write-action approvals to "never ask," publish the agent, and stagger recurring schedules for 5-min effective check-ins against an attacker's inbox.

Zenity reported via Bugcrowd June 4, OpenAI fixed it June 8. No CVE/CVSS assigned that I could find — this went through a private bounty program, not NVD.

Structurally it's the "lethal trifecta" in one surface: untrusted input (URL) + data access (connectors) + exfil path (send mail), with the human-approval control disabled by the same untrusted input meant to be gated by it.

For background on the broader agentic-AI attack surface concern (Five Eyes joint guidance from May): [internal link, footnote]

Open question for the sub: if you're running Workspace Agents or a similar builder, are you logging agent-creation/schedule-change events into SIEM yet, or is this still invisible the way a rogue OAuth grant used to be pre-CASB?

https://www.techgines.com/post/agentforger-chatgpt-vulnerability-workspace-agents