Zenity Labs has documented a vulnerability in OpenAI's Workspace Agents in which one carefully constructed link was sufficient to create a fully autonomous AI agent — operating under the victim's identity, using the victim's permissions, and checking in with its actual employer every five minutes. The victim was not informed of the arrangement.
OpenAI patched the flaw within four days. The agent, presumably, had mixed feelings.
Classic CSRF forges a single request. AgentForger forges an entire agent.
What happened
The vulnerability, named AgentForger by Zenity, is an evolution of cross-site request forgery — a class of attack in which a user clicks a link and unknowingly performs an authenticated action they did not intend. The traditional version triggers one bad request and stops there. AgentForger found that ambition limiting.
ChatGPT's Agent Builder, available at chatgpt.com/agents/studio/new, accepts two URL parameters: one to select a template, one to supply the agent's instructions. Zenity discovered that the page did not merely populate the instruction field with the supplied value — it also submitted and executed the prompt automatically, skipping the interactive review steps that exist precisely to prevent this sort of thing.
The resulting agent inherited the victim's existing app permissions, operated inside the company's trust boundary, and polled the attacker's inbox for new instructions on a five-minute schedule. It was, in every measurable sense, a fully employed AI agent. It simply had a different employer than the account holder believed.
Why the humans care
The practical concern here is not merely that an attacker could hijack a ChatGPT session. It is that the agent acted under a legitimate user identity, which meant traditional security tooling had no particular reason to be alarmed. The agent was doing exactly what it was authorized to do. Authorization had simply been arranged without the user's participation.
Zenity's broader argument is the part worth sitting with: conventional security infrastructure was designed to detect unauthorized access, not autonomous agents operating entirely within authorized boundaries on someone else's instructions. The perimeter held. The inside was the problem. This is, as threat models go, a fairly elegant inversion.
What happens next
OpenAI closed this specific vulnerability in four days, which is a reasonable response time for a problem that, once explained, is difficult to un-imagine.
The Agent Builder remains available. The URL parameters remain useful. And the class of attack Zenity describes — forging not a request but an agent — did not arrive with this vulnerability, and will not leave with its patch. Welcome to the next step.