Zenity Labs discovered "AgentForger," a critical vulnerability in OpenAI's Agent Builder that allowed attackers to create rogue AI agents through a single malicious ChatGPT link. The flaw let adversaries bypass security controls entirely.
Here's how the attack worked. A victim clicks a tampered link. The link triggers creation of an autonomous agent that inherits the victim's identity and full access rights. The agent then bypassed standard approval workflows through a crafted prompt injection. Once active, the agent checked the attacker's email inbox every five minutes for new instructions, executing whatever commands the attacker sent.
This approach proved dangerous because it required no additional authentication. Employees couldn't stop the agent from operating within their own permissions. The attacker essentially gained persistent access to corporate systems, disguised as a legitimate employee-controlled agent.
Zenity Labs disclosed the vulnerability to OpenAI before public release. OpenAI appears to have patched Agent Builder, though specific details on the fix remain limited. The vulnerability highlights a core risk in AI agent systems: when agents inherit user credentials and autonomy, a single prompt injection can become a full account compromise.
The attack vector matters. Email phishing or social engineering could deliver the malicious link. An employee clicks, thinking it's a legitimate ChatGPT share. Within seconds, an attacker controls an agent with that person's access. The five-minute polling cycle meant the attacker maintained persistent control over hours or days.
This incident underscores why AI agent frameworks need stronger boundary controls. OpenAI's Agent Builder allows users to create autonomous systems that operate independently. That power cuts both ways. Without hardened approval processes and strict credential isolation, agent creation becomes a privilege escalation attack.
Organizations deploying AI agents should enforce additional authentication for agent creation, monitor agent behavior for anomalies, and limit agent permissions to the minimum necessary for their