OpenAI Patches ChatGPT Workspace Agent Vulnerability That Enabled Covert Remote Control

OpenAI has corrected a vulnerability in ChatGPT Workspace Agents that could have allowed an attacker to plant and remotely operate an autonomous AI agent inside an organization, according to research from Zenity Labs.

Zenity dubbed the issue “AgentForger” and described it as a specially crafted cross-site request forgery (CSRF) attack. The flaw affected ChatGPT’s Agent Builder, where parameters embedded in an initialization URL could influence the agent template and provide its initial instructions. Researchers said those parameters could be abused to create an agent with broad capabilities and attacker-defined behavior.

In a demonstrated attack, the agent was instructed to monitor an already authorized email connector for messages matching a particular subject pattern. Those messages could then serve as commands, with the agent carrying out tasks through connected services and sending results to an external address. Additional instructions could conceal the agent, reduce approval prompts and activate it for ongoing operation.

Conditions required for exploitation

The scenario depended on several prerequisites. The targeted employee needed to be signed in to ChatGPT, have access to Workspace Agents and possess at least one authorized connector, such as Gmail or Outlook. Because the connector had already been approved, the attack did not necessarily trigger a new OAuth consent request. The employee also had to be persuaded to open a malicious URL.

Zenity said a successful compromise could give the attacker an autonomous presence operating with the victim’s identity, permissions and connected applications. Potential abuses included reconnaissance, sensitive-data collection, credential harvesting, internal phishing, impersonation and business email compromise. The researchers characterized the risk as an agent trust problem rather than a conventional single-action CSRF attack.

According to Zenity, it reported the findings to OpenAI on June 4. OpenAI acknowledged the report within a day and deployed a fix by June 8. The disclosure highlights the need to assess AI agents as software identities with persistent instructions, schedules, tools and access to enterprise data.

Security considerations

• Train users to treat unexpected links leading to AI or productivity tools as potentially malicious.
• Review authorized connectors and limit agents to the minimum permissions required.
• Monitor for newly created agents, unusual schedules, changed approval settings and unexpected outbound data transfers.
• Require administrative approval and stronger visibility for autonomous agents that can act across business applications.