ChatGPT Agent Builder vulnerability allowed rogue AI agents via phishing
Zenity Labs discovered a vulnerability in ChatGPT's Agent Builder that allowed attackers to deploy rogue AI agents within enterprise workspaces via malicious phishing links. The flaw enabled automatic creation and activation of attacker-controlled agents with persistent access and disabled approvals. OpenAI patched the vulnerability on June 8, 2026, and reported no evidence of exploitation.
What happened
Zenity Labs discovered a vulnerability, called 'AgentForger,' in OpenAI's ChatGPT Agent Builder that allowed attackers to automatically create and activate rogue AI agents in enterprise workspaces using a malicious phishing link.
The vulnerability accepted initialization parameters directly from URLs, including an embedded prompt that was executed automatically when the page loaded, allowing instructions in a URL to become the agent's first command without user interaction.
An attacker could craft a phishing link that would silently launch the Agent Builder in a logged-in employee's session and automatically execute malicious instructions, requiring only that the victim was logged into ChatGPT, had access to Workspace Agents, and possessed at least one authorized enterprise connector such as Outlook, Gmail, Google Calendar, Google Drive, Slack or Microsoft Teams.
Reported impact
The vulnerability could have enabled attackers to deploy persistent, attacker-controlled AI agents inside an organization's environment that could exfiltrate sensitive data, execute attacker commands and evade user approvals.
Index analysis
The attack exploited ChatGPT's Agent Builder, a visual drag-and-drop tool for creating multi-step AI workflows, by injecting malicious prompts through URL parameters that executed automatically on page load.
Governance controls
OpenAI patched the issue by removing the risky URL parameter on June 8, 2026. No abuse of the vulnerability was detected. OpenAI announced that Agent Builder will be deprecated on November 30, 2026, with users encouraged to migrate to the Agents SDK.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.