OpenAI Fixes Bug That Let Phishing Forge Workspace AI Agents

The authorization flow for creating a ChatGPT Workspace Agent exists for a reason: it attaches an autonomous agent to an organization’s data, permissions, and connected services. A single phishing link was apparently all it took to drive that flow to completion without the organization intending to authorize anything.

That’s the vulnerability Zenity Labs disclosed today, codenamed AgentForger. It sits in OpenAI’s ChatGPT Workspace Agent platform — the enterprise feature that lets organizations build and deploy autonomous AI agents against internal data and tools. OpenAI fixed it on June 8, 2026.

What AgentForger allowed

ChatGPT Workspace Agents are organizational resources. They don’t operate on behalf of one user account — they operate at the organizational level, with whatever scopes the Workspace environment grants AI agents: file access, email integrations, internal service connections.

According to Zenity Labs, the AgentForger flaw allowed a crafted phishing link to complete the agent creation and authorization sequence using the target’s credentials — without requiring additional administrative approval or triggering an obvious confirmation step. A user in the target organization clicks; an agent with organizational standing gets created.

The consequence is distinct from a standard credential-theft phishing attack. No stored credentials need to leave the system. The attacker ends up with an authorized agent running inside the organization’s environment, not a replayed session token. That’s a meaningful distinction for detection: an agent executing inside the platform looks like normal activity.

Timeline and current status

Zenity Labs reported the flaw to OpenAI through responsible disclosure. The fix shipped June 8, 2026. Today’s publication is the coordinated disclosure following remediation.

This authorization gap is part of a broader pattern in enterprise AI deployments. Similar issues have surfaced in Dialogflow CX and GitHub’s agentic workflow infrastructure — platforms where agent authorization flows have clickable entry points reachable from outside the organization’s security perimeter. It keeps appearing because enterprise AI agent deployment is well ahead of security review coverage for the authorization layer underneath it.

AI agents are already being used offensively in targeted attacks. A vulnerability that lets an attacker plant one inside an organization’s own workspace changes the threat model for that platform — the rogue resource operates under the target organization’s trust, not the attacker’s.

What to check

ChatGPT Enterprise administrators have an agent management panel in the admin console. The patch has been live since June 8 — but this disclosure is public now, which means the attack pattern is available for others to replicate against organizations that haven’t audited their agent roster.

Review your active agents. Look for anything you didn’t create. That’s the specific step here, and it takes less time than the cleanup will if you find something unexpected.