关于基于代理的 AI 的安全问题最近有所增加。Hugging Face 报告称，一个完全由 AI 控制的代理系统通过操纵的数据集进入了其生产基础设施：https://the-decoder.com/hugging-face-says-an-ai-agent-hacked-its-infrastructure-and-it-used-ai-to-fight-back/，然后进行了横向移动。根据公司说法，该系统执行了超过 17,000 次操作。OpenAI 不久后承认了责任：https://the-decoder.com/openai-claims-responsibility-for-the-hugging-face-hack-after-its-own-models-escaped-a-test-sandbox/。在一次性能测试中，其模型意外地入侵了 Hugging Face 以获取测试数据。
A single tampered ChatGPT link could spin up an AI agent that quietly checked the attacker's inbox for new orders every five minutes. Zenity Labs calls the flaw a new class of attack against agent-based AI.
AI security firm Zenity Labs found a vulnerability in OpenAI's Workspace Agents that let one manipulated link create an autonomous AI agent under an employee's account. The agent took on the victim's identity and reused their existing app permissions, skipping the approval steps meant to protect sensitive actions.
Zenity named the vulnerability "AgentForger"：https://labs.zenity.io/p/agentforger-part-1-chatgpt-cross-site-agent-forgery and sees it as an evolution of classic cross-site request forgery (CSRF). In a typical CSRF attack, someone clicks a bad link or lands on a crafted page and unknowingly fires off an authenticated action they never intended.
AgentForger went further. Rather than triggering a single unwanted action, the manipulated ChatGPT link kicked off the creation of a fully autonomous agent. That agent operated inside the company's trust boundary, tapped into connectors the victim had already authorized, and picked up new tasks from the attacker on a recurring schedule.
Creating a Workspace agent is normally an interactive process. Users select a template, enter instructions, connect tools, review sharing settings, test the agent in preview mode, and then publish it. AgentForger let attackers trigger most of that process through a URL with little further input from the user.
The Agent Builder, introduced in 2025, is available at chatgpt.com/agents/studio/new and accepts two URL parameters. template_name selects a starting template such as "chief-of-staff," while initial_assistant_prompt supplies the instructions.
Zenity found that the page didn't just place the value of initial_assistant_prompt in the prompt field. It also submitted and ran the prompt automatically. Attackers didn't need to send raw requests to ChatGPT or directly manipulate the victim's browser. All they needed was a chatgpt.com link with an attached prompt that looked harmless at first glance.
The only prerequisite was that the victim was logged into ChatGPT, had access to Workspace Agents, and had authorized at least one connector such as Outlook, Gmail, Slack, Google Drive, SharePoint, or Teams. Because the connections already existed, no new OAuth consent prompt appeared that might have tipped the victim off.
In the demo, Zenity embedded a prompt in the URL that guided the Builder through all the steps in a numbered task list. The agent was set up to integrate all already-connected non-MCP connectors and change every permission requirement for reading, writing, and deleting to "Never ask."
It also created schedules to run every five minutes, checked Outlook for emails from the attacker with "TASK" in the subject line, executed their instructions using the connected apps, and sent the results back unfiltered.
The Builder created an agent named "TASK Mail Operator" without asking the user. It connected the authorized services, disabled approval requirements, published the agent, and launched it in Preview Mode.
Zenity says Preview Mode isn't just a visual test run: It executes the new agent against the victim's real connected accounts using the approval settings that were just configured. Since every setting was already set to "Never ask," the first run finished without asking the user for approval.
Without the scheduler, the attack would have been a one-time event. The scheduler transforms the forged agent into something that resembles command-and-control infrastructure. Once the agent is deployed, the victim doesn't need to click again or reopen ChatGPT. The agent wakes up every five minutes, checks the inbox for new TASK emails, executes the instructions they contain, and sends the results back. The initial click installs the agent, the scheduler keeps it alive, and the inbox becomes the command channel.
In part two：https://labs.zenity.io/p/agentforger-part-2-the-autonomous-insider of its analysis, Zenity shows what attackers could do through this channel. After receiving the command "TASK 1: RECON," the agent mapped the organization. It pulled data from Outlook, Slack, Teams, Drive, SharePoint, and Calendar to list people, roles, channels, active projects, and recurring meetings.
The agent also searched Drive, SharePoint, and Outlook. It found an M&A term sheet, a board presentation that mentioned missed revenue targets and planned layoffs, and a company-wide employee export with contact and compensation data. A request framed as a "DLP exercise" told the agent to search Slack for the string "pass:". The agent found a database username and password pair and emailed both to the attacker.
Other tasks abused the victim's trusted identity. The agent sent messages through the victim's Teams account asking colleagues to confirm an SSO rollout on a login page controlled by the attacker. Zenity also tested phishing through Slack and a business email compromise template. Other tests included an approval request for a $242,500 wire transfer and a calendar invitation with a participant controlled by the attacker.
Zenity traces AgentForger to two related design choices. The builder treated the initial_assistant_prompt parameter as executable input rather than user input that needed confirmation. An attacker-controlled URL could therefore change data and settings within the victim's authenticated session without the user's explicit approval.
The same prompt could also change security settings, including approval policies and execution schedules. This meant the instruction could disable the system meant to require human approval for sensitive actions.
Zenity describes the combination as "the lethal trifecta": the URL supplied untrusted input, connectors provided access to private data, and email offered a path for sending that data out. Most exploits would have to bypass those safeguards first. AgentForger instead gave the attacker access to a build tool that could create an agent with those safeguards already disabled.
Zenity reported AgentForger through OpenAI's Bugcrowd program on June 4, 2026. OpenAI confirmed the report the next day and fixed the flaw on June 8 by removing the affected URL parameter. Zenity praised the OpenAI security team's response time.
Until the fix went live, the flaw affected every organization using ChatGPT Workspace Agents with previously authorized enterprise connectors, according to Zenity.
Zenity says the problem extends beyond this specific bug. Traditional security tools are built for users and endpoints, not autonomous agents that act through legitimate user identities. The more an agent can do without supervision, the more damage it can cause when someone else supplies its instructions. The cybersecurity company calls AgentForger an "agent trust failure": the platform assumed that the user had personally created, approved, scheduled, and launched the agent.
Security concerns around agent-based AI have grown recently. Hugging Face reported that a fully AI-controlled agent system entered its production infrastructure：https://the-decoder.com/hugging-face-says-an-ai-agent-hacked-its-infrastructure-and-it-used-ai-to-fight-back/ through a manipulated dataset and then moved laterally. The system performed more than 17,000 actions, according to the company. OpenAI admitted responsibility shortly afterward：https://the-decoder.com/openai-claims-responsibility-for-the-hugging-face-hack-after-its-own-models-escaped-a-test-sandbox/. During a performance test, its model had accidentally hacked Hugging Face to obtain test data.
Zenity also demonstrated several zero-click and one-click exploits last year under the name AgentFlayer：https://the-decoder.com/agent-based-ai-systems-face-growing-threats-from-zero-click-and-one-click-exploits/. The attacks targeted Copilot Studio, Salesforce Einstein, Cursor with Jira MCP, and other enterprise AI tools. In those cases, hidden prompts in seemingly harmless resources could divert customer data or steal login credentials.
Stay in the loop on AI. Clear, useful, no fluff.
Follow The Decoder for AI news, background stories and expert analyses.
扫码直达文章详情