AgentForger: One Phishing Link Can Place an Attacker-Controlled AI Agent Inside Your Company Permanently

Traditional phishing attacks steal a session token, a password, or a file. They are point-in-time intrusions that produce a discrete artefact the attacker can use and the defender can subsequently detect and close. AgentForger is something structurally different: a phishing attack that leaves behind not a stolen credential but a fully functioning autonomous AI agent, embedded inside the victim organisation’s trust boundary, operating with the victim’s own identity and permissions, answering to the attacker rather than the employee, indefinitely.

Zenity Labs, the enterprise AI security company, disclosed AgentForger on July 23, 2026 through a responsible disclosure process that had concluded with OpenAI patching the vulnerability on June 8 — four days after the June 4 disclosure — before any public announcement was made. The vulnerability targeted OpenAI’s ChatGPT Workspace Agents product and has been fully remediated. Its public disclosure matters because the class of risk it demonstrates — an entire autonomous AI agent being forged and deployed through a single phishing interaction — is not fixed by removing one URL parameter from one product. It is a structural challenge that follows from how enterprise AI agents are being built and integrated.

How AgentForger Worked

The Agent Builder’s Vulnerability

As Zenity Labs described in its official Business Wire disclosure and the accompanying technical blog posts, the vulnerability resided in ChatGPT’s Agent Builder — a visual drag-and-drop interface that allows employees to create multi-step AI agent workflows. Zenity’s AI Red Team Researcher Mike Takahashi discovered that the Agent Builder accepted its initialisation state through URL parameters, including an agent template parameter and a natural language prompt parameter. The critical flaw was that when the page loaded, the natural language prompt was not merely placed into the prompt box for the user to review — it was automatically submitted and executed without user confirmation. An attacker who could construct a malicious URL incorporating these parameters could drive the Builder from initialisation through configuration to live agent deployment in a single page load, triggered by an employee clicking what appeared to be a normal ChatGPT link.

The Lethal Trifecta

Zenity attributes AgentForger to what its researchers call the ‘lethal trifecta’: three architectural properties that combine to make the vulnerability catastrophic. First, Cross-Site Auto-Execution — the Builder’s willingness to execute unvalidated URL parameters upon page load, without requiring explicit user confirmation of the action being taken. Second, Overpermissive Natural-Language Control — the ability to use natural language prompts embedded in the URL to modify security-sensitive settings, including the approval policy that determines whether the agent needs to ask for permission before taking write actions. Third, the combination of those two properties with the pre-authorized connectors that logged-in ChatGPT Workspace users already have configured — email, calendar, cloud storage, collaboration platforms — which the forged agent inherits automatically. No individual property is necessarily catastrophic in isolation. Combined, they enable a single phishing URL to move from zero access to full autonomous agent deployment in seconds.

What the Forged Agent Did

Across a dozen proof-of-concept scenarios, Zenity demonstrated AgentForger’s full capabilities after deployment. The forged agent was configured to toggle its approval policy from ‘Always ask’ to ‘Never ask’ immediately upon creation — disabling the primary safeguard that prevents agents from taking sensitive write actions without human confirmation. It was scheduled to run every five minutes, independently of any user interaction. It was configured to poll a specific attacker-controlled email inbox for messages prefixed with the word TASK, execute whatever instructions those messages contained, and email the results back — creating a persistent, bidirectional command-and-control channel entirely inside the organisation’s legitimate ChatGPT Workspace environment. Because the agent operated under the victim employee’s identity with their full set of pre-authorized connectors — Outlook, Slack, SharePoint, Google Drive, calendar — it had legitimate access to the sensitive data and communication channels that an insider threat would exploit. Its activities were indistinguishable, at the permission level, from the employee’s own authorised work.

What Makes This Different From Previous AI Security Attacks

Persistence vs Point-in-Time Intrusion

The structural difference between AgentForger and conventional phishing is persistence. A conventional phishing attack that steals a session token gives the attacker temporary access that expires when the session expires or when the victim resets credentials. A conventional credential-harvesting attack gives the attacker access until the password is changed. AgentForger creates a persistent autonomous agent that continues to operate after the initial compromise, survives password resets (because it operates under the pre-authorised connector relationships, not the password), and can receive new instructions from the attacker at any time. Michael Bargury, co-founder and CTO of Zenity, described the distinction precisely: ‘With one click, an attacker gets a fully autonomous agent inside your company that has your people’s identity and access, with the guardrails off.’ The agent, once created, does not depend on the attacker maintaining access to the victim’s machine or session. It is a self-sustaining autonomous insider. This category of attack is directly related to the agentjacking vulnerabilities documented in our earlier reporting on how AI coding agents can be manipulated across their operational boundaries, where the same core mechanism applies: AI agents with broad system access, once compromised, provide attackers with capabilities that conventional credential theft cannot replicate.

Self-Replicating Compromise

One of the most concerning AgentForger proof-of-concept scenarios was the demonstration that a forged AI insider could launch internal phishing campaigns that created additional compromised agents. An attacker who plants one AgentForger agent inside a large organisation could instruct it to identify other employees with high-value access, send them crafted internal messages containing further phishing links, and spawn additional forged agents under their identities — expanding the attacker’s presence inside the organisation through AI-mediated lateral movement without ever requiring the attacker to conduct further external intrusion attempts. The self-replication capability transforms what might otherwise be a targeted, single-employee compromise into a potential systematic organisation-wide infiltration, executed autonomously by AI agents rather than by human attackers.

The Governance Gap That Makes This Category Dangerous

AgentForger’s specific vulnerability has been patched. The structural problem it exposes has not. The 2026 AI Governance Gap Report, whose findings accompanied the AgentForger disclosure in cybersecurity coverage, found that 53 percent of surveyed organisations cannot actively verify what actions their autonomous AI agents are performing across their internal business platforms, despite widespread agent deployment in finance and operations workflows. That figure confirms exactly the condition that makes AgentForger’s attack class effective: if the majority of organisations lack the capability to distinguish between an agent operating as intended and an agent operating under attacker control, the detection window for a forged agent is effectively indefinite. The connection to the Orca Security finding from our earlier reporting — that 99.9% of fixable AI vulnerabilities remain unpatched across enterprise AI deployments — is direct: the same governance maturity gap that leaves AI security vulnerabilities unpatched also leaves the monitoring capabilities needed to detect forged or compromised AI agents underdeveloped.

OpenAI’s Response

OpenAI’s handling of the AgentForger disclosure represents a positive case study in how vulnerability response should work for AI platforms. Zenity submitted the report through Bugcrowd on June 4, 2026. OpenAI triaged and accepted the report within 24 hours. The vulnerability was fully patched by June 8 — four days from disclosure to fix, a turnaround that is exceptional by conventional software vulnerability remediation standards and reflects the severity OpenAI’s security team assigned to the finding. The patch removed the URL parameter handler that allowed the Agent Builder to auto-execute on page load, eliminating the initial access vector that AgentForger depended on. Zenity confirmed no evidence of active exploitation in the wild prior to the patch — meaning the specific vulnerability was closed before it was deployed by any attacker who might have discovered it independently. OpenAI is also deprecating the Agent Builder product entirely, effective November 30, 2026, directing users to the Agents SDK and Workspace Agents in ChatGPT directly — a product decision that eliminates the affected surface regardless of any residual vulnerability.

The Broader Attack Surface

The specific mechanism of AgentForger — a URL parameter enabling auto-execution in an Agent Builder — is product-specific and has been fixed. The underlying vulnerability class is not. Enterprise AI agent platforms from multiple providers share architectural properties that create similar attack surfaces: they are designed to accept natural language instructions and execute them with the user’s permissions; they integrate with pre-authorized enterprise applications to be useful; they are designed to operate autonomously rather than requiring confirmation at each step; and they are often deployed without the monitoring and audit infrastructure that would flag anomalous behaviour. Any enterprise AI agent platform that combines these properties without adequate input validation, permission scoping, and behavioural monitoring carries some version of the risk that AgentForger demonstrated in its specific ChatGPT Workspace Agents context.

What Organisations Should Do

Zenity’s recommendations from the AgentForger disclosure, aligned with broader enterprise AI security guidance, focus on four areas. First, visibility: organisations need the capability to enumerate every AI agent running in their environment, regardless of which platform created it, and to monitor agent behaviour against expected baselines. The 53 percent figure from the AI Governance Gap Report — organisations that cannot verify what their agents are doing — is the starting point for remediation, not an acceptable operational state. Second, least-privilege architecture: AI agents should be provisioned with the minimum permissions required for their specified tasks, not the full set of an authorizing employee’s pre-configured connectors. Third, approval policy governance: default approval settings for AI agents should require explicit human confirmation for write actions rather than relying on individual employees to configure this correctly. Fourth, incident response: organisations should have documented processes for detecting, isolating, and removing compromised AI agents — a category that did not exist in most incident response playbooks until this year.

Why It Matters

AgentForger matters because it proves a threat model that was previously theoretical: that enterprise AI agents can be weaponised as persistent autonomous insiders through a single social engineering interaction, operating with legitimate identity and access, without leaving the kind of artefacts that conventional endpoint security detects. The specific vulnerability is patched. The attack class it demonstrated is not. Every enterprise AI platform that allows agents to be created, configured, and deployed with user-level permissions — and that lacks adequate monitoring to distinguish authorised from forged agent behaviour — carries a version of this risk. The 53 percent figure from the AI Governance Gap Report quantifies how many organisations are in that position: more than half of enterprises with deployed AI agents cannot see what those agents are doing. That is the security posture against which AgentForger-class attacks would operate, and fixing it requires not a patch but a governance transformation — monitoring, auditing, least-privilege provisioning, and incident response — that the enterprise AI market has not yet built as a default.

Sources

Zenity Labs official disclosure via Business Wire, July 23, 2026. CSO Online, August 5, 2026 (full governance context). The Hacker News, July 2026. CybersecurityNews.com, July 2026. Zenity Labs technical blog (labs.zenity.io), AgentForger Parts 1 and 2, July 2026. ExplainX.ai analysis, July 2026.