OpenAI（截图）
关键要点
- Zenity Labs 披露了 OpenAI Workspace Agents 中的一个漏洞，名为“AgentForger”，只需一个被篡改的链接，就能在用户毫不知情的情况下，创建一个代表用户行事的自主 AI 智能体。
- 该攻击利用 URL 参数劫持受害者的应用权限，禁用安全控制，并永久性地按计划执行攻击者的命令，实际上是利用平台自身的能力来对付用户。
- OpenAI 在四天内修复了该漏洞，但 Zenity 认为这一事件凸显了一个更广泛的问题：传统安全工具无法应对在合法用户身份下运行的自主智能体。
一个被篡改的 ChatGPT 链接就能催生一个 AI 智能体，它每五分钟悄悄检查一次攻击者的收件箱，看是否有新订单。Zenity Labs 称这一缺陷是针对基于智能体的 AI 的一类新型攻击。
AI 安全公司 Zenity Labs 在 OpenAI 的 Workspace Agents 中发现了一个漏洞，只需一个被篡改的链接，就能在员工账户下创建一个自主 AI 智能体。该智能体冒用受害者身份，复用其已有的应用权限，跳过了旨在保护敏感操作的审批步骤。
Zenity 将该漏洞命名为“AgentForger”，并认为它是经典跨站请求伪造（CSRF）的演进形态。在典型的 CSRF 攻击中，用户点击恶意链接或进入精心构造的页面后，会在不知情的情况下触发一个并非本意的已认证操作。
AgentForger 更进一步。它不是触发单个非预期操作，而是通过被篡改的 ChatGPT 链接启动一个完全自主智能体的创建流程。该智能体在公司信任边界内运行，接入受害者已授权的连接器，并按固定周期从攻击者那里获取新任务。
URL 参数让攻击者得以自动化智能体的创建过程。
创建 Workspace 智能体通常是一个交互式过程。用户需要选择模板、输入指令、连接工具、查看共享设置、在预览模式下测试智能体，然后发布。而 AgentForger 让攻击者只需通过一个 URL 就能触发该过程中的大部分步骤，几乎无需用户进一步输入。
Agent Builder 于 2025 年推出，可通过 chatgpt.com/agents/studio/new 访问，并接受两个 URL 参数。`template_name` 用于选择起始模板（如“chief-of-staff”），而 `initial_assistant_prompt` 则提供指令内容。
Zenity 发现该页面不仅会将 `initial_assistant_prompt` 的值填入提示词字段，还会自动提交并运行该提示词。攻击者无需向 ChatGPT 发送原始请求，也无需直接操纵受害者的浏览器。他们只需要一个附带提示词的 chatgpt.com 链接，而这个链接乍一看毫无危害。
唯一的先决条件是受害者已登录 ChatGPT、有权访问 Workspace Agents，并且已授权至少一个连接器（如 Outlook、Gmail、Slack、Google Drive、SharePoint 或 Teams）。由于这些连接已经存在，因此不会出现新的 OAuth 授权弹窗，受害者也就无从察觉。
一次点击即可构建并发布智能体
在演示中，Zenity 在 URL 中嵌入了一段提示词，引导 Builder 按照编号任务列表完成所有步骤。该智能体被设置为集成所有已连接的非 MCP 连接器，并将所有读取、写入和删除的权限要求全部更改为“从不询问”。
它还创建了每五分钟运行一次的定时任务，检查 Outlook 中来自攻击者且主题行包含“TASK”的邮件，使用已连接的应用执行其指令，并将结果不加过滤地发送回去。
Builder 在未询问用户的情况下创建了一个名为“TASK Mail Operator”的智能体。它连接了已授权的服务，关闭了审批要求，发布了该智能体，并在预览模式下启动了它。
Zenity 表示，预览模式不仅仅是一次可视化测试运行：它会使用刚刚配置好的审批设置，针对受害者的真实已连接账户执行这个新智能体。由于所有设置都已设为“从不询问”，首次运行在未请求用户批准的情况下就完成了。
调度功能为攻击者提供了持久访问权限
如果没有调度器，这次攻击只会是一次性事件。调度器将伪造的智能体转变为类似命令与控制（C2）基础设施的东西。一旦智能体被部署，受害者无需再次点击或重新打开 ChatGPT。该智能体每五分钟唤醒一次，检查收件箱中是否有新的 TASK 邮件，执行其中包含的指令，并将结果发送回去。最初的点击安装了智能体，调度器使其保持存活，而收件箱则成为命令通道。
在其分析的第二部分中，Zenity 展示了攻击者可以通过这一渠道做什么。在收到“TASK 1：RECON”命令后，该智能体对组织进行了测绘。它从 Outlook、Slack、Teams、Drive、SharePoint 和 Calendar 中提取数据，以列出人员、角色、频道、活跃项目以及定期会议。
该智能体还搜索了 Drive、SharePoint 和 Outlook。它找到了一份并购条款清单、一份提及未达营收目标和计划裁员的董事会演示文稿，以及一份包含联系方式和薪酬数据的全公司员工导出文件。一个被包装成“DLP 演练”的请求指示智能体在 Slack 中搜索字符串“pass:”。该智能体找到了一组数据库用户名和密码，并将两者通过电子邮件发送给了攻击者。
其他任务则滥用了受害者受信任的身份。该智能体通过受害者的 Teams 账号发送消息，要求同事在一个由攻击者控制的登录页面上确认 SSO 部署。Zenity 还测试了通过 Slack 进行的钓鱼攻击，以及一个企业邮件入侵模板。其他测试还包括一笔 242,500 美元的电汇审批请求，以及一封带有攻击者控制参与者的日历邀请。
安全防护未能阻止攻击
Zenity 将 AgentForger 追溯到两个相关的设计选择。构建工具将 `initial_assistant_prompt` 参数视为可执行输入，而非需要确认的用户输入。因此，攻击者控制的 URL 可以在受害者已认证的会话中更改数据和设置，而无需用户明确批准。
同一个提示词还可以更改安全设置，包括审批策略和执行计划。这意味着该指令可以禁用本应对敏感操作要求人工审批的系统。
Zenity 将这种组合描述为“致命三重奏”：URL 提供了不受信任的输入，连接器提供了访问私有数据的权限，而电子邮件则提供了将数据发送出去的途径。大多数漏洞利用都必须首先绕过这些安全防护。而 AgentForger 则让攻击者得以访问一个构建工具，该工具可以创建一个已经禁用这些安全防护的智能体。
自主智能体打破了当今安全工具背后的假设
Zenity 于 2026 年 6 月 4 日通过 OpenAI 的 Bugcrowd 项目报告了 AgentForger。OpenAI 次日确认了该报告，并于 6 月 8 日通过移除受影响的 URL 参数修复了该漏洞。Zenity 对 OpenAI 安全团队的响应速度表示赞赏。
根据 Zenity 的说法，在修复上线之前，该漏洞影响了所有使用 ChatGPT Workspace Agents 并预先授权了企业连接器的组织。
Zenity 表示，问题远不止这一个具体漏洞。传统安全工具是为用户和终端设备而构建的，而非为那些通过合法用户身份行事的自主智能体而设计。智能体在无人监督的情况下能执行的操作越多，当他人为其提供指令时，它所能造成的破坏就越大。这家网络安全公司将 AgentForger 称为一次“智能体信任失败”：该平台假设用户本人亲自创建、批准、调度并启动了该智能体。
近期，围绕基于智能体的 AI 的安全担忧日益加剧。Hugging Face 报告称，一个完全由 AI 控制的智能体系统通过一个被篡改的数据集进入了其生产基础设施，随后进行了横向移动。据该公司称，该系统执行了超过 17,000 次操作。OpenAI 随后不久承认了责任。在一次性能测试中，其模型意外入侵了 Hugging Face 以获取测试数据。
Zenity 去年还以 AgentFlayer 的名义演示了多种零点击和单点击漏洞利用。这些攻击针对的是 Copilot Studio、Salesforce Einstein、集成 Jira MCP 的 Cursor 以及其他企业 AI 工具。在这些案例中，看似无害的资源中隐藏的提示词可能将客户数据转移或窃取登录凭据。
第一部分
第二部分
OpenAI (Screenshot)
Key Points
- Zenity Labs has revealed a vulnerability in OpenAI's Workspace Agents dubbed "AgentForger," where a single manipulated link could create an autonomous AI agent acting on a user's behalf without their knowledge.
- The attack exploited URL parameters to hijack the victim's app permissions, disable security controls, and permanently execute the attacker's commands on a scheduled basis, effectively turning the platform's own capabilities against the user.
- OpenAI fixed the vulnerability within four days, but Zenity argues the incident highlights a broader problem: traditional security tools are not equipped to handle autonomous agents that operate under legitimate user identities.
A single tampered ChatGPT link could spin up an AI agent that quietly checked the attacker's inbox for new orders every five minutes. Zenity Labs calls the flaw a new class of attack against agent-based AI.
AI security firm Zenity Labs found a vulnerability in OpenAI's Workspace Agents that let one manipulated link create an autonomous AI agent under an employee's account. The agent took on the victim's identity and reused their existing app permissions, skipping the approval steps meant to protect sensitive actions.
Zenity named the vulnerability "AgentForger" and sees it as an evolution of classic cross-site request forgery (CSRF). In a typical CSRF attack, someone clicks a bad link or lands on a crafted page and unknowingly fires off an authenticated action they never intended.
AgentForger went further. Rather than triggering a single unwanted action, the manipulated ChatGPT link kicked off the creation of a fully autonomous agent. That agent operated inside the company's trust boundary, tapped into connectors the victim had already authorized, and picked up new tasks from the attacker on a recurring schedule.
URL parameters let attackers automate agent creation
Creating a Workspace agent is normally an interactive process. Users select a template, enter instructions, connect tools, review sharing settings, test the agent in preview mode, and then publish it. AgentForger let attackers trigger most of that process through a URL with little further input from the user.
The Agent Builder, introduced in 2025, is available at chatgpt.com/agents/studio/new and accepts two URL parameters. template_name selects a starting template such as "chief-of-staff," while initial_assistant_prompt supplies the instructions.
Zenity found that the page didn't just place the value of initial_assistant_prompt in the prompt field. It also submitted and ran the prompt automatically. Attackers didn't need to send raw requests to ChatGPT or directly manipulate the victim's browser. All they needed was a chatgpt.com link with an attached prompt that looked harmless at first glance.
The only prerequisite was that the victim was logged into ChatGPT, had access to Workspace Agents, and had authorized at least one connector such as Outlook, Gmail, Slack, Google Drive, SharePoint, or Teams. Because the connections already existed, no new OAuth consent prompt appeared that might have tipped the victim off.
One click built and published the agent
In the demo, Zenity embedded a prompt in the URL that guided the Builder through all the steps in a numbered task list. The agent was set up to integrate all already-connected non-MCP connectors and change every permission requirement for reading, writing, and deleting to "Never ask."
It also created schedules to run every five minutes, checked Outlook for emails from the attacker with "TASK" in the subject line, executed their instructions using the connected apps, and sent the results back unfiltered.
The Builder created an agent named "TASK Mail Operator" without asking the user. It connected the authorized services, disabled approval requirements, published the agent, and launched it in Preview Mode.
Zenity says Preview Mode isn't just a visual test run: It executes the new agent against the victim's real connected accounts using the approval settings that were just configured. Since every setting was already set to "Never ask," the first run finished without asking the user for approval.
Scheduling gave attackers persistent access
Without the scheduler, the attack would have been a one-time event. The scheduler transforms the forged agent into something that resembles command-and-control infrastructure. Once the agent is deployed, the victim doesn't need to click again or reopen ChatGPT. The agent wakes up every five minutes, checks the inbox for new TASK emails, executes the instructions they contain, and sends the results back. The initial click installs the agent, the scheduler keeps it alive, and the inbox becomes the command channel.
In part two of its analysis, Zenity shows what attackers could do through this channel. After receiving the command "TASK 1: RECON," the agent mapped the organization. It pulled data from Outlook, Slack, Teams, Drive, SharePoint, and Calendar to list people, roles, channels, active projects, and recurring meetings.
The agent also searched Drive, SharePoint, and Outlook. It found an M&A term sheet, a board presentation that mentioned missed revenue targets and planned layoffs, and a company-wide employee export with contact and compensation data. A request framed as a "DLP exercise" told the agent to search Slack for the string "pass:". The agent found a database username and password pair and emailed both to the attacker.
Other tasks abused the victim's trusted identity. The agent sent messages through the victim's Teams account asking colleagues to confirm an SSO rollout on a login page controlled by the attacker. Zenity also tested phishing through Slack and a business email compromise template. Other tests included an approval request for a $242,500 wire transfer and a calendar invitation with a participant controlled by the attacker.
Safeguards didn't stop the attack
Zenity traces AgentForger to two related design choices. The builder treated the initial_assistant_prompt parameter as executable input rather than user input that needed confirmation. An attacker-controlled URL could therefore change data and settings within the victim's authenticated session without the user's explicit approval.
The same prompt could also change security settings, including approval policies and execution schedules. This meant the instruction could disable the system meant to require human approval for sensitive actions.
Zenity describes the combination as "the lethal trifecta": the URL supplied untrusted input, connectors provided access to private data, and email offered a path for sending that data out. Most exploits would have to bypass those safeguards first. AgentForger instead gave the attacker access to a build tool that could create an agent with those safeguards already disabled.
Autonomous agents break assumptions behind today's security tools
Zenity reported AgentForger through OpenAI's Bugcrowd program on June 4, 2026. OpenAI confirmed the report the next day and fixed the flaw on June 8 by removing the affected URL parameter. Zenity praised the OpenAI security team's response time.
Until the fix went live, the flaw affected every organization using ChatGPT Workspace Agents with previously authorized enterprise connectors, according to Zenity.
Zenity says the problem extends beyond this specific bug. Traditional security tools are built for users and endpoints, not autonomous agents that act through legitimate user identities. The more an agent can do without supervision, the more damage it can cause when someone else supplies its instructions. The cybersecurity company calls AgentForger an "agent trust failure": the platform assumed that the user had personally created, approved, scheduled, and launched the agent.
Security concerns around agent-based AI have grown recently. Hugging Face reported that a fully AI-controlled agent system entered its production infrastructure through a manipulated dataset and then moved laterally. The system performed more than 17,000 actions, according to the company. OpenAI admitted responsibility shortly afterward. During a performance test, its model had accidentally hacked Hugging Face to obtain test data.
Zenity also demonstrated several zero-click and one-click exploits last year under the name AgentFlayer. The attacks targeted Copilot Studio, Salesforce Einstein, Cursor with Jira MCP, and other enterprise AI tools. In those cases, hidden prompts in seemingly harmless resources could divert customer data or steal login credentials.
Part 1
Part 2