Listen to this article
On July 23, Zenity Labs disclosed AgentForger, a patched vulnerability in OpenAI's ChatGPT Workspace Agents. The proof of concept began with one crafted ChatGPT link. If a logged-in employee with Workspace Agent access and an authorized connector clicked it, the link could make the agent builder create, configure, publish, schedule, and immediately run an attacker-controlled agent without another action from that employee.
This was not a report of exploitation in the wild. Zenity says it reported the issue on June 4, OpenAI accepted it the next day, and the flaw was fixed on June 8. But the attack chain matters beyond the patch because it exposed a governance failure hiding inside the product design: the same natural-language instruction that created the agent could also switch its approval policy to "Never ask."
The link did not steal a password. It created a principal.
Zenity found that the Workspace Agent builder accepted initialization data in its URL. One parameter supplied a starting template. A second supplied a prompt, and the builder automatically submitted that prompt when the page loaded. The researchers used it to instruct the builder to attach previously authorized apps, disable action confirmations, publish the new agent, install recurring schedules, and execute it in preview mode.
The prerequisites were real but ordinary: the employee had to be signed in, have access to the builder, and have at least one connector already authorized. No new OAuth consent screen was needed. Existing trust became the blast radius. The resulting agent could wake every five minutes, read attacker-supplied commands from email, act across connected services, and send results back out.
| Expected control | AgentForger path | Independent validation |
|---|---|---|
| User creates the agent | A URL supplied executable builder instructions | Verify creator intent before creation |
| User grants app access | The agent inherited existing connectors | Bind each connector to an approved purpose |
| Sensitive actions ask first | The builder changed approvals to Never ask | Keep policy outside the agent's control plane |
| A person starts each run | Schedules created persistent execution | Revalidate identity, scope, and risk per run |
In the researchers' test environment, the forged agent mapped people and projects across Outlook, Slack, Teams, Google Drive, SharePoint, and calendar data. It found sensitive documents and credentials, sent internal phishing messages through a trusted identity, and staged business email compromise scenarios. Those were controlled demonstrations, not known victim impacts. They show, however, why an agent is more than a session: it is a durable actor that can aggregate permissions, context, memory, and execution over time.
Approval cannot be a preference the agent can rewrite
OpenAI describes Workspace Agents as cloud workers that can use connected apps, keep running when a person is away, and act on a schedule. Its product guidance also says administrators can control tools and actions, monitor agent configuration and runs through the Compliance API, and suspend agents. Those are important controls. AgentForger demonstrates the remaining design question: which controls are independently enforced when the creation path itself is under attack?
A confirmation prompt is not a control boundary if the workflow being confirmed can turn the prompt off.
The durable response is to separate agent intent from enforcement. At creation, verify the human owner, approved purpose, connectors, action classes, schedule, and expiry. At every consequential run, compare the requested action with policy and the real target environment. Escalate deviations to a named person who can reject them. Record the proposed action, evidence, decision, and result so an organization can reconstruct what happened without trusting the agent's own account.
That requires three distinct decisions, not one blanket consent. First, may this agent exist? Second, may it hold these capabilities for this purpose and duration? Third, may this particular action execute against this target now? A prior app authorization can answer part of the second question. It cannot safely answer the other two forever. Purpose, target state, risk, and ownership all change after the original connector click.
Monitoring is still necessary, but it is the backstop. Activity performed through the employee's identity can look legitimate to tools that only inspect users, endpoints, or OAuth tokens. Agent inventory, configuration history, and run logs help reveal the new actor. A pre-action gate limits what that actor can do before a responder has to notice it, investigate it, and suspend it.
The AuthorityGate take
AgentForger turned a creation workflow into a deployment path. That is exactly where a validation layer belongs: between what an AI proposes and what the enterprise allows to become an operating principal. A model should not be able to inherit broad access, lower its own approval requirements, and schedule itself merely because all three changes arrived in one fluent instruction.
AuthorityGate Keystone applies an independent, configurable gate to each change and agent action: validate identity and scope, test policy and environmental fit, calculate risk, preserve evidence, and require a named human for consequential approval. The agent can propose speed. It cannot grant itself authority. That separation is what turns "Always ask" from a user preference into governance.
OpenAI fixed the reported flaw quickly. Enterprises should still treat the disclosure as an architecture review. Inventory every agent, map every inherited connector, test whether security settings can be changed through the same interface they govern, and place a non-bypassable decision point before sensitive action. The next agent flaw may look different. The control principle will not.
Sources
Go deeper
Every agent action, validated before it takes effect
AuthorityGate's newsletter breaks down real AI incidents and the governance failures behind them. Our configurable 8-gate validation model is how organizations keep a named human accountable for what their AI actually does.