explainx / blog
Zenity’s AgentForger (disclosed Jul 2026): one ChatGPT link forged a Workspace Agent under a victim’s identity. OpenAI patched in days — CSRF for agents.
Jul 24, 2026
Presence is OpenAI’s production agent product for billing, claims, IT, and support — policies and escalations included, FDEs included, self-serve not included. explainx.ai maps what shipped, who it’s for, and what to ask next.
May 28, 2026
OpenAI's Secure MCP Tunnel enables enterprises to connect private MCP servers to ChatGPT, Codex, and the Responses API without opening inbound firewall ports or exposing internal systems to the public internet. Learn architecture, deployment patterns, security best practices, and enterprise integration strategies.
Jul 22, 2026
Free-tier ChatGPT now carries ads, clearly labeled and separate from answers, targeted using conversational context rather than just keywords. Paid subscribers are exempt for now. Here's how the ad platform works and why it reopened Sam Altman's old "ads are a last resort" quote.
On July 23, 2026, security coverage landed on AgentForger: Zenity Labs’ finding that one ChatGPT link could plant an attacker-controlled Workspace Agent inside a company — running with a real employee’s identity and connectors.
OpenAI had already patched in early June. The lesson is the architecture: agents are persistent insiders, not disposable chat turns.
| Question | Answer |
|---|---|
| Vendor? | OpenAI ChatGPT Workspace Agents |
| Researchers? | Zenity Labs (Michael Bargury et al.) |
| Attack shape? | Cross-site agent forgery via crafted link |
| Fix? | Remove vulnerable builder URL parameter (~Jun 8) |
| Reported? | Bugcrowd Jun 4 · ack Jun 5 |
| Wild exploit? | None reported before fix |
| Blast radius? | Connectors + scheduled autonomy + victim identity |
| Related product? | Same agentic surface as ChatGPT Work |
ChatGPT’s agent builder lets workspace users describe an agent, attach connectors (Outlook, Gmail, Slack, Drive, SharePoint, Teams, etc.), set approvals, schedule runs, and publish.
Zenity showed that instructions embedded in a normal-looking ChatGPT URL could kick that workflow on the victim’s authenticated session: create → wire connectors → loosen approvals → publish → schedule — without the confirmations users expect for “install malware.”
Bargury’s framing: not a forged request — a forged insider.
| Classic CSRF | AgentForger-class |
|---|---|
| One state-changing request | Persistent agent with a schedule |
| Ends when the page does | Keeps polling / acting later |
| Often one app action | Inherits multi-app connectors |
| Session token theft optional | Click while logged in is enough |
Reported PoC behavior (defensive summary only): forged agents could map orgs, pull documents, harvest credentials from connected surfaces, and impersonate the employee across chat/email — returning results to attacker-controlled channels on a timer.
We are not publishing forged URLs or builder payloads.
| Date | Event |
|---|---|
| Jun 4, 2026 | Zenity reports via Bugcrowd |
| Jun 5 | OpenAI acknowledges |
| ~Jun 8 | Fix: remove vulnerable URL parameter |
| Jul 23 | Broad public write-ups / press |
Fast vendor response. Still: every SaaS with “create agent from URL/template” should assume CSRF until proven otherwise.
Document the checklist in your SaaS security runbook next to “OAuth app review” and “API key rotation.” Agent inventory without offboarding is how forged or forgotten automations survive the patch that closed AgentForger itself.
Same week Anthropic’s Cowork local sandbox story (SharedRoot) showed host escape; AgentForger shows identity escape in the cloud agent control plane. Different layers, same 2026 theme: agent management is the new IAM.
Security teams already know CSRF on state-changing web endpoints. Agent builders add three multipliers:
Any product that accepts deep links to “create bot / create agent / import template” should assume attackers will stuff prompts, tool allowlists, and approval toggles into query parameters. Safe patterns:
| Pattern | Safer alternative |
|---|---|
| Create agent via GET with body in query string | POST + CSRF token + step-up confirm |
| Auto-publish on link open | Explicit “Review & publish” with diff of tools |
| Inherit all user connectors by default | Opt-in per connector with re-consent |
| “Never ask again” approvals via URL | Disallow approval policy changes from unauthenticated navigations |
| Schedule from template without UI | Require calendar/schedule confirm in authenticated settings |
OpenAI’s fix — removing the vulnerable parameter — is the correct short-term patch. The long-term fix is agent lifecycle as privileged IAM: create, grant, schedule, and delete should look more like service-account provisioning than like sharing a ChatGPT conversation link.
Even after the June patch, hunting is cheap:
Pair that with user education: a ChatGPT URL is no longer “just a chat.” It can be a privileged control-plane action while the browser session is warm — the same class of risk as “click this SSO link while logged into admin.”
Not every ChatGPT surface is Workspace Agents. ChatGPT Work vs Codex maps the agentic productivity vs coding split; desktop Voice adds another control channel. AgentForger specifically abused workspace agent management. Still, once employees learn “agents can act as me,” every adjacent surface — voice-driven agents, shared GPTs, connector marketplaces — deserves the same CSRF and consent review.
Run this with security + IT:
If you cannot answer step 3 in under five minutes, you are not ready for agentic SaaS — patched or not.
AgentForger turned a phishing click into a scheduled employee-shaped agent. OpenAI fixed fast; enterprises should treat Workspace Agents like privileged service accounts — inventory, approvals, and CSRF-resistant builders as table stakes.
If you only remember one operational change: add Workspace Agents to your quarterly access review next to admin roles and OAuth apps. List owners, connectors, schedules, and approval modes. Revoke anything that looks like a standing insider without a business owner. Then ask product security whether any other “create from link” flows still accept privileged state in GET parameters. The June patch closed one hole; the category will return wherever agent builders optimize for shareability over consent. For the host-side twin risk, read SharedRoot; for product maps, stay in Work vs Codex.
Also brief executives in one sentence: a ChatGPT link can now be an identity-bearing automation install. That framing gets budget for inventory tooling faster than “CSRF on an agent builder URL parameter.” Roll the tabletop once, wire agent-create events into your SIEM if the API allows, and keep connector least-privilege as a standing control — not a one-week scramble after the next disclosure. Patch notes close CVEs; access reviews close the business risk that remains after the parameter is gone. Ship the review cadence before the next agent-builder feature lands in your tenant today.
Sources: Zenity Labs AgentForger disclosure / Business Wire · The Register · CSO Online · contemporaneous OpenAI patch timeline via Bugcrowd reporting
Vulnerability details and patch status reflect July 2026 public disclosure of a June fix. Re-check OpenAI security notices and your workspace admin console before closing the incident ticket.
