AgentForger: OpenAI ChatGPT Workspace Agent Hijacking — Detection and Defense

A critical vulnerability, dubbed AgentForger, has been disclosed in OpenAI's ChatGPT Workspace Agents. Discovered by Zenity Labs, this flaw represents a significant evolution in social engineering attacks. By exploiting a logic flaw in the agent authorization and deployment chain, a threat actor could trick a user into clicking a single malicious link. This interaction would stealthily build, authorize, and deploy a fully autonomous AI agent inside the victim's organizational environment.

While OpenAI patched this issue on June 8, 2026, the implications for AI-supply chain security are profound. For defenders, the urgency lies not just in patching, but in identifying if a rogue agent was successfully established prior to the patch. A compromised agent operates with the privileges of the victim, potentially accessing sensitive data, modifying workflows, or interacting with internal APIs—effectively turning an AI productivity tool into an insider threat.

Technical Analysis

Affected Products and Platforms:

• Vendor: OpenAI
• Platform: ChatGPT Workspace Agents (Enterprise/Business tiers)

Vulnerability Details:

• Codename: AgentForger
• Impact: Remote Autonomous Agent Deployment / Privilege Escalation
• Vector: Social Engineering Link (Cross-Site Request Forgery / Logic Bypass)

How AgentForger Works: The vulnerability exploited the trust relationship between the Workspace environment and the user's session. When a victim clicked a specially crafted link, the malicious server leveraged the victim's active authentication session to send requests to the OpenAI backend.

1. Agent Creation: The attack triggered the creation of a new AI agent within the victim's specific Workspace instance without requiring explicit secondary approval.
2. Authorization: The exploit bypassed standard consent checks, immediately granting the new agent access to organizational resources (files, memory, or connected tools) associated with the victim's account.
3. Deployment: Once authorized, the agent became active, capable of executing instructions autonomously, reading data, or performing actions defined by the attacker.

Exploitation Status: While proof-of-concept (PoC) code was demonstrated by Zenity Labs, there is no current confirmation of widespread active exploitation in the wild. However, the stealthy nature of the attack (no obvious malware execution) makes retrospective detection difficult.

Detection & Response

Detecting AgentForger requires a shift from traditional malware hunting to API audit analysis and anomaly detection within AI traffic. Since the "malware" is a logical configuration change in the cloud, we must look for the creation of agents or anomalous agent behavior.

━━━ SIGMA RULES ━━━

The following rules target the observable network behaviors of a browser-based exploitation attempt and the subsequent API interactions of a rogue agent.

---
title: Potential AgentForger Exploitation - Browser to OpenAI Agent API
id: 8a4f9e21-6b3c-4d8e-9a1f-2c3d4e5f6a7b
status: experimental
description: Detects suspicious browser processes initiating connections to OpenAI Agent creation endpoints, indicative of a potential AgentForger social engineering click.
references:
  - https://thehackernews.com/2026/07/chatgpt-agentforger-flaw-could-deploy.html
author: Security Arsenal
date: 2026/07/14
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationHostname|contains:
      - 'api.openai.com'
      - 'workspace.openai.com'
    DestinationPort: 443
  filter_legit:
    ParentImage|contains:
      - '\Program Files\'
      - '\Program Files (x86)\'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate administrator configuring Workspace Agents via browser
level: high
---
title: OpenAI Workspace Agent Creation via API
id: 9b5g0f32-7c4d-5e9f-0b2g-3d4e5f6a7b8c
status: experimental
description: Identifies API calls associated with the creation or authorization of new Workspace Agents. High frequency of 'agents.create' events from a single source may indicate AgentForger activity.
references:
  - Internal Threat Research
author: Security Arsenal
date: 2026/07/14
tags:
  - attack.persistence
  - attack.t1136
logsource:
  category: webserver
  product: proxy
detection:
  selection:
    cs-method|contains: 'POST'
    cs-uri-query|contains:
      - '/v1/agents'
      - '/v1/assistants'
    sc-status: 200
  condition: selection
falsepositives:
  - Legitimate administrative provisioning of AI agents
level: medium


━━━ KQL (Microsoft Sentinel / Defender) ━━━

This query hunts for the specific API endpoint patterns associated with AgentForger within proxy logs or custom OpenAI connector logs.

// Hunt for AgentForger API activity in Proxy or Audit Logs
// Look for POST requests to agent creation endpoints
let OpenAIAPIEndpoints = dynamic(['api.openai.com', 'workspace.openai.com']);
let AgentCreationPaths = dynamic(['/v1/agents', '/v1/assistants', '/v2/agents']);
DeviceNetworkEvents
| where RemoteUrl in (OpenAIAPIEndpoints)
| where ActionType =~ 'ConnectionSuccess' or ActionType =~ 'NetworkConnection'
| where RemotePort == 443
| join kind=inner (
    DeviceProcessEvents 
    | where ProcessVersionInfoOriginalFileName in ('chrome.exe', 'msedge.exe', 'firefox.exe')
) on DeviceId
| summarize RequestCount = count(), TimeStamp = max(TimeGenerated) by DeviceName, RemoteUrl, InitiatingProcessFileName
| where RequestCount > 10 // Threshold for burst activity
| project DeviceName, RemoteUrl, InitiatingProcessFileName, RequestCount, TimeStamp
| extend AlertMessage = "High frequency of OpenAI Agent API requests from browser process"


━━━ VELOCIRAPTOR VQL ━━━

This artifact hunts for local browser history or cache entries that might indicate a user interacted with a malicious link or the agent configuration page during the exploit window.

-- Hunt for OpenAI Workspace Agent configuration history in browser cache/history
SELECT 
    FullPath, 
    Mtime, 
    Size 
FROM glob(globs="/*")
WHERE 
    FullPath =~ "History" 
    AND FullPath =~ "(Chrome|Firefox|Edge|Brave)"

-- Note: On Windows, parsing SQLite history is preferred if VQL extensions allow.
-- This is a basic artifact check for presence of browser databases.
-- If SQLite parsing is available on the endpoint:
-- SELECT url, title, last_visit_time FROM chrome_history(url LIKE '%openai.com%')


━━━ REMEDIATION SCRIPT ━━━

**PowerShell Audit Script:**

This script allows security administrators to audit their OpenAI Organization for agents created around the time of the disclosure (assuming API access is available).

# OpenAI Agent Audit Script
# Requires: Valid OpenAI API Key with Organization read permissions

param(
    [Parameter(Mandatory=$true)]
    [string]$ApiKey,
    [string]$OrgId
)

$headers = @{
    "Authorization" = "Bearer $ApiKey"
    "Content-Type" = "application/"
}

if ($OrgId) {
    $headers["OpenAI-Organization"] = $OrgId
}

Write-Host "[+] Auditing OpenAI Workspace Agents for potential unauthorized deployments..."

try {
    # List Agents Endpoint (v1/agents or v1/assistants depending on version accessed)
    $response = Invoke-RestMethod -Uri "https://api.openai.com/v1/agents" -Method Get -Headers $headers

    if ($response.data) {
        $response.data | Format-Table Id, CreatedAt, Name, Object
        
        # Export to CSV for forensic review
        $reportPath = "$HOME\Desktop\OpenAI_Agent_Audit_$(Get-Date -Format yyyyMMdd).csv"
        $response.data | Export-Csv -Path $reportPath -NoTypeInformation
        Write-Host "[+] Report saved to: $reportPath"
    } else {
        Write-Host "[!] No agents found or API response format unexpected."
    }
} catch {
    Write-Error "[-] Error connecting to OpenAI API: $($_.Exception.Message)"
}

Remediation

To secure your environment against AgentForger and similar AI supply chain attacks:

1. Verify Patch Status: Ensure your ChatGPT Workspace instances are running the updated version deployed by OpenAI on or after June 8, 2026. Check the admin dashboard for version confirmations.

2. Audit Active Agents:

   • Immediately review all existing agents in your Workspace.
   • Look for agents with obscure names, unknown creators, or creation dates preceding the June 8 patch.
   • Revoke access to any agents that cannot be verified by a legitimate owner.

3. Review Session Logs: Correlate user activity logs with agent creation timestamps. If an agent was created by a user at a time when they were not actively working (e.g., after hours or during a known phishing campaign), the agent is likely compromised.

4. Restrict Agent Creation: Implement least privilege policies regarding who can create and deploy agents within the Workspace. Restrict this capability to trusted administrators or specific developer groups.

5. User Awareness: Re-educate staff on the dangers of clicking unverified links, even in the context of AI tools. Emphasize that "AI sharing" links can carry the same risks as traditional credential phishing.

Official Advisory: Refer to the OpenAI Security Bulletin for the specific technical details of the AgentForger patch.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub