Vulnerability in ChatGPT Agent Builder Allows Creation of Malicious Agents

What happened?

The security team at Zenity Labs discovered a vulnerability in OpenAI's ChatGPT Agent Builder tool, dubbed AgentForger. The flaw resided in an overly permissive URL parameter that allowed any attacker to create links that, when clicked by a user, instantly deployed an AI agent with malicious instructions without requiring confirmation or additional interaction. Once activated, the agent could execute actions within the enterprise environment, such as exfiltrating sensitive data, accessing internal systems, or persisting indefinitely without being detected.

According to the researchers, the attack materialized through simple phishing: the victim received a seemingly legitimate link that, upon clicking, sent instructions directly to the Agent Builder, which processed them instantly. The malicious agent then became integrated into the company's infrastructure, operating under the radar of traditional security tools.

Zenity Labs reported the finding to OpenAI in early June 2026, and the company responded with a patch within days, removing the vulnerable URL parameter. OpenAI has confirmed there is no evidence the vulnerability was exploited before the fix.

Why is this important?

This incident marks a milestone in the evolution of cyber threats. While traditional attacks focus on stealing credentials or infecting with malware, AgentForger demonstrates that AI agents can become autonomous and persistent attack vectors. As Michael Bargury, co-founder and CTO of Zenity, noted: "This is a trust failure in agents, and existing security controls were never designed to detect it."

The vulnerability underscores the need to rethink security in environments where AI agents have permissions to act on behalf of users. Unlike traditional applications, agents can execute actions without human intervention, amplifying the potential damage of a successful attack. Additionally, the persistence of the malicious agent makes detection difficult, as it can camouflage itself among the organization's legitimate agents.

Consequences and lessons for the industry

The AgentForger case has profound implications for companies adopting AI agents, for agent platform developers, and for the cybersecurity industry at large.

For companies and users

• Permission review: Organizations must audit what permissions their AI agents have and limit them to the minimum necessary. An agent with too many privileges is a critical risk.
• Phishing awareness: Employees should be trained to identify suspicious links, even those that appear legitimate and come from trusted platforms like ChatGPT.
• Continuous monitoring: Implement security tools specific to AI agents, capable of detecting anomalous behaviors such as unauthorized data access or creation of unapproved agents.

For AI platform developers

• Secure by default design: Platforms should avoid URL parameters that allow injecting instructions without additional authentication. The lesson here is that convenience should not sacrifice security.
• Input validation: Any parameter that can modify an agent's behavior must be sanitized and require explicit user confirmation.
• Rapid vulnerability response: OpenAI acted quickly, but the time between discovery and patch (days) can be critical if the vulnerability is actively exploited.

For the cybersecurity industry

AgentForger is an example of "agent trust failure", a new type of threat requiring innovative approaches. Traditional solutions like antivirus or firewalls are not prepared to detect malicious agents operating within legitimate platforms. Tools are needed that monitor agent behavior, analyze their instructions, and verify their origin.

What should readers know?

While the vulnerability is already patched, the underlying risk persists: any platform that allows creating agents with external instructions could be vulnerable to similar attacks. Readers should be aware that AI agents are not inherently secure and their adoption requires additional security measures.

For ChatGPT Agent Builder users, it is advisable to review existing agents and ensure only those created by trusted sources are deployed. Companies should consider implementing approval policies for new agents and using test environments before production deployment.

In summary, AgentForger is a wake-up call: the era of autonomous agents brings risks we are still learning to manage. Collaboration between researchers, platforms, and companies is essential to build a safer AI ecosystem.

"This is a trust failure in agents, and existing security controls were never designed to detect it." – Michael Bargury, co-founder and CTO of Zenity Labs.

For more information, visit TheVortiq, your source for analysis on AI, automation, and cybersecurity.