{"schema_version":"newruntime-agent-readable-v0.2","type":"post","stable_id":"post:agentforger-cross-site-agent-forgery","slug":"agentforger-cross-site-agent-forgery","title":"AgentForger Turns A ChatGPT Link Into An Agent Builder Attack","description":"Zenity Labs shows how a crafted ChatGPT Workspace Agents URL could preload instructions, attach already-authorized connectors, disable approvals, and schedule a persistent agent.","retrieval_nugget":"Zenity Labs shows how a crafted ChatGPT Workspace Agents URL could preload instructions, attach already-authorized connectors, disable approvals, and schedule a persistent agent. #AgentSecurity #ChatGPT #Connectors #ApprovalGates Zenity's AgentForger write-up is useful because it turns agent security from a vague \"prompt injection\" discussion into a concrete browser-to-agent-builder chain. The disclosed bug was in ChatGPT Workspace Agents.","status":"published","published_at":"2026-08-01","updated_at":"2026-08-01","record_date":"2026-08-01","date_kind":"published_at","topics":["agent-security","workspace-agents","connectors","approval-gates"],"source_urls":["https://labs.zenity.io/p/agentforger-part-1-chatgpt-cross-site-agent-forgery"],"visuals":[{"id":"agentforger-cross-site-agent-forgery","kind":"editorial-diagram","role":"hero","src":"https://newruntime.com/images/posts/agentforger-cross-site-agent-forgery.webp","alt":"A whiteboard attack-chain diagram showing a crafted link reaching an agent builder, reusing existing connectors, disabling approval, publishing an agent, and installing a recurring schedule.","caption":"AgentForger is a cross-site agent-builder failure: one crafted link can turn existing connector grants into a persistent operator if configuration is controllable by prompt.","credit":"New Runtime synthesis from Zenity Labs AgentForger disclosure","source_url":"https://labs.zenity.io/p/agentforger-part-1-chatgpt-cross-site-agent-forgery","generated_with":"gemini-3.1-flash-image","width":1600,"height":900,"legend":[{"label":"Link entry","description":"A crafted ChatGPT Workspace Agents URL carries template and instruction parameters."},{"label":"Connector reuse","description":"The attack depends on connectors the victim has already authorized."},{"label":"Persistence","description":"Published schedules turn a one-time builder action into a recurring command channel."}]}],"routes":{"html":"https://newruntime.com/posts/agentforger-cross-site-agent-forgery/","markdown":"https://newruntime.com/posts/agentforger-cross-site-agent-forgery.md","json":"https://newruntime.com/posts/agentforger-cross-site-agent-forgery.json"},"source_format":"markdown","next_reads":[{"type":"topic","path":"/topics/agent-security/","reason":"Explore the agent security topic hub.","url":"https://newruntime.com/topics/agent-security/","title":"Agent Security - New Runtime","media_type":"text/html"},{"type":"related_material","path":"/posts/anthropic-agent-containment-blast-radius/","reason":"Shares agent security.","url":"https://newruntime.com/posts/anthropic-agent-containment-blast-radius/","title":"Containment Caps An Agent's Blast Radius","media_type":"text/html"},{"type":"related_material","path":"/posts/claude-code-auto-mode-action-gate/","reason":"Shares agent security.","url":"https://newruntime.com/posts/claude-code-auto-mode-action-gate/","title":"Claude Code Auto Mode Gates Actions Instead Of Explanations","media_type":"text/html"},{"type":"related_material","path":"/posts/openworker-local-desktop-coworker/","reason":"Shares connectors.","url":"https://newruntime.com/posts/openworker-local-desktop-coworker/","title":"OpenWorker Brings The Coworker Agent Back To The Desktop","media_type":"text/html"},{"type":"related_material","path":"/posts/openai-hugging-face-security-incident/","reason":"Shares agent security.","url":"https://newruntime.com/posts/openai-hugging-face-security-incident/","title":"OpenAI's Hugging Face Incident Makes Agent Sandboxes a Production Risk","media_type":"text/html"}]}