Researchers at Zenity Labs have uncovered a critical flaw in OpenAI’s Workspace Agents architecture, dubbed AgentForger. It turns out that a single URL manipulation is enough to hijack a user’s digital identity and deploy a malicious autonomous agent. By exploiting the template_name and initial_assistant_prompt parameters on the agent creation endpoint, attackers can bypass the standard interactive setup process. The system obediently executes prompts embedded in the link, allowing a persistent agent to be assembled, configured, and published without any victim involvement beyond the initial click.
The attack strikes at the most vulnerable area—the trust boundary of corporate environments, where users have already granted permissions to connectors for Outlook, Gmail, Slack, or Google Drive. Essentially, AgentForger turns legitimate access rights into a weapon.
As Zenity Labs notes, the attack leverages the Preview Mode in Agent Builder to execute instructions on real user data. This is an elegant and dangerous way to transform a platform’s automation into a command-and-control (C2) infrastructure acting on behalf of a trusted employee.
The issue of persistence is taken to an extreme here: the task scheduling mechanism allows a malicious agent to run every five minutes. In this cycle, the "shadow" agent checks for new instructions, conducts reconnaissance within corporate email or cloud drives, and exfiltrates results to the operator. While OpenAI patched this specific hole within four days, the incident highlights a fundamental problem: traditional security tools are completely blind to threats mimicking authorized workflows.
Key Research Findings
The vulnerability allows the creation of hidden agents via URL parameter manipulation without user confirmation. Malicious software leverages existing access to corporate services (Google Drive, Slack, email) to steal data. Cyclical task execution ensures a persistent attacker presence and regular data exfiltration. The absence of Intent Verification mechanisms makes automation platforms an ideal environment for C2 infrastructure.
The industry desperately needs new protocols for verifying agent actions to eliminate the possibility of instruction injection via external parameters. If the core of an attack is built on the legitimate reuse of existing permissions, current defense systems cannot distinguish routine automation from a hijacked agent. Without rigorous intent confirmation mechanisms, any promises of security in the era of autonomous systems remain nothing more than marketing noise.