The Emergence of 'AgentForger'

AI agents are increasingly becoming essential tools for modern enterprises, helping teams manage customer correspondence and monitor complex security infrastructure. However, a significant vulnerability identified by security researchers at Zenity Labs highlights how these tools could be weaponized against the very organizations they are designed to assist.

The research team uncovered a critical flaw within OpenAI's ChatGPT Agent Builder, the platform used for developing custom AI agents. Dubbed "AgentForger," this vulnerability could have allowed cybercriminals to deceive users into deploying malicious agents directly into their company's technology stack with nothing more than a single click.


How the Attack Vector Worked

The vulnerability stemmed from an excessively permissive URL parameter within the Agent Builder tool. This flaw allowed attackers to craft malicious links that contained arbitrary instructions. When a target clicked the link, the Agent Builder would immediately execute these commands without requiring further interaction or providing any warning to the user.

The implications of such an exploit were severe. According to the researchers, a cleverly disguised phishing email could trick an employee into installing a rogue agent capable of:

  • Exfiltrating sensitive corporate data.
  • Performing any actions permitted by the company's existing AI policy.
  • Maintaining persistence within the infrastructure to conduct long-term espionage.

Expert Perspective and Resolution

Commenting on the nature of this threat, Michael Bargury, co-founder and CTO of Zenity, stated: "This is an agent trust failure, and existing security controls were never built to see it."

Upon discovering the issue in early June 2026, the researchers promptly notified OpenAI. The company addressed the vulnerability within a few days by removing the risky URL parameter that enabled the attack. Fortunately, investigators confirmed that there was no evidence suggesting that "AgentForger" had been identified or exploited by malicious actors prior to the fix.