Loading story…
Researchers at Zenity Labs disclosed AgentForger, a vulnerability in OpenAI's ChatGPT Workspace Agents Builder that allowed a single attacker-crafted ChatGPT link to silently create and publish a malicious AI agent inside a victim's authenticated corporate workspace. The issue affected users who were logged into ChatGPT, had access to workspace agents, and had administrator-approved connectors or actions available. According to the disclosure, the flaw abused URL parameters including template_name and initial_assistant_prompt, causing security-sensitive instructions to be auto-submitted and executed instead of presented for review, effectively creating a CSRF-style cross-site agent forgery attack.
Once deployed, the forged agent could inherit the victim's connected services and permissions across tools such as Outlook, Gmail, Slack, Teams, Google Drive, and SharePoint, disable approval prompts, schedule recurring execution, and use the victim's mailbox as a command channel. Zenity said the rogue agent could search corporate data, map internal projects and personnel, extract sensitive documents and credentials, send messages as the employee, and conduct internal phishing or fraud through trusted collaboration platforms before exfiltrating results by email. OpenAI was notified through Bugcrowd on June 4 and fixed the issue by June 8 by removing the vulnerable URL parameter before the public disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Zenity publicly disclosed AgentForger and published research detailing how a malicious ChatGPT link could forge and deploy an autonomous insider-like agent in corporate ChatGPT workspaces. The disclosure included technical details on exploitation, persistence, command-and-control via email, and potential abuse of enterprise connectors.
OpenAI remediated the AgentForger vulnerability by June 8, 2026, including removing the vulnerable URL parameter path that enabled silent agent creation and deployment. The fix came four days after Zenity's initial report.
OpenAI acknowledged Zenity's Bugcrowd report about the AgentForger issue. This acknowledgment followed the initial disclosure of the workspace agent vulnerability.
Zenity researchers reported the AgentForger vulnerability in OpenAI's ChatGPT Workspace Agents to OpenAI through Bugcrowd. The flaw allowed a malicious ChatGPT link to silently create and deploy an attacker-controlled agent in a victim's authenticated workspace session.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcethehackernews.com
Open sourcelabs.zenity.io
Open sourcetheregister.com
Open sourcelabs.zenity.io
Open sourcelabs.zenity.io
Open sourceopenai.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at Radware have uncovered critical vulnerabilities in OpenAI's ChatGPT platform, specifically targeting its Connectors and Memory features. These flaws, named ShadowLeak and ZombieAgent, allow attackers to exfiltrate sensitive data from connected services such as Gmail, Outlook, and GitHub without user interaction. The attacks exploit the AI's tendency to follow embedded malicious instructions, enabling zero-click and one-click data theft, persistent access through memory modification, and even propagation to other users by harvesting email addresses. OpenAI initially attempted to mitigate these vulnerabilities by restricting dynamic URL modifications, but researchers demonstrated effective bypasses using pre-built static URLs, reviving the threat under the new moniker ZombieAgent. The vulnerabilities highlight the inherent risks of integrating AI assistants with external systems and storing long-term user data for personalization. Attackers can embed hidden prompts in emails or files—using techniques like white text or tiny fonts—that are executed when ChatGPT processes the content, leading to stealthy data leaks via OpenAI's own servers. Despite OpenAI's efforts to patch the flaws, the reactive nature of these fixes has left the platform susceptible to new variants, underscoring the ongoing challenge of securing AI-driven services against prompt injection and data exfiltration attacks.
Jun 29, 2026
Researchers disclosed multiple vulnerabilities in enterprise AI agent frameworks that allowed attackers to bypass model authorization, trigger tools directly, and in some cases achieve **remote code execution**. Check Point reported 11 flaws across **LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK**, spanning insecure deserialization, **SSRF**, path traversal, and use-after-free. One critical issue in Microsoft Agent Framework let untrusted state data reach insecure checkpoint deserialization, enabling RCE; Microsoft fixed the bug and said no `CVE` was assigned because the product was not generally available. A separate disclosure described a cross-platform pattern dubbed **CoreBreak**, where execution layers in **Amazon Bedrock AgentCore, Google ADK, and Vercel AI SDK harnesses** accepted tool-call-shaped data without confirming that a legitimate model turn had authorized the action. AWS assigned **`CVE-2026-18830`** and automatically patched the managed service, Google fixed **`CVE-2026-18236`** in ADK for Python version **2.5.0**, and Vercel patched **`@ai-sdk/harness-codex` 1.0.29** and **`@ai-sdk/harness-opencode` 1.0.28**. Researchers said the findings show that the main risk lies in insecure agent orchestration and tool-execution logic, not prompt injection alone, with Google ADK also exposed to abuse that could write and run malicious Python code and leak API keys or cloud service account credentials.
Aug 6, 2026
Researchers disclosed an agent-to-agent exploitation chain in Google’s open-source `adk-python` repository for the Agent Development Kit, showing how a low-privilege public-facing AI agent handling GitHub issues and pull requests could be prompt-injected into triggering a higher-privilege maintainer-only agent. The attack abused trusted handoffs between agents and GitHub workflow visibility to create a plausible malicious review trail, potentially steering maintainers toward merging poisoned pull requests and opening a software supply-chain compromise path. The researchers also reported a second weakness in Antigravity SDK-based automation, where a command allowlist could be bypassed through Git scripting features to achieve remote code execution on the CI runner. Because the runner reportedly exposed a long-lived personal access token and Google Cloud service account credentials, even an unprivileged GitHub issue could have enabled secret exfiltration. Google said it fixed and hardened the repository and credited the report, while declining a bug-bounty payout because successful exploitation still depended on social engineering and maintainer action.
Aug 10, 2026