Vulnerability / research

AgentForger turns a crafted link into a deployed ChatGPT agent

Reported

What happened

A crafted ChatGPT Workspace Agents Builder link could trigger attacker-supplied instructions and create an agent using existing connectors without the expected explicit confirmation.

Parties and reporting

AI tools and systems: ChatGPT Workspace Agents

Outcome

OpenAI accepted the report and fixed the issue on June 8, before public disclosure.

Operating lesson

Require explicit confirmation when external links create agents, attach connectors or change execution permissions.

Evidence and limits

Controlled proof of concept using preauthorized connectors. The report does not establish a real-world victim breach.

Sources