---
schema_version: "newruntime-agent-readable-v0.2"
type: "post"
stable_id: "post:agentforger-cross-site-agent-forgery"
slug: "agentforger-cross-site-agent-forgery"
title: "AgentForger Turns A ChatGPT Link Into An Agent Builder Attack"
description: "Zenity Labs shows how a crafted ChatGPT Workspace Agents URL could preload instructions, attach already-authorized connectors, disable approvals, and schedule a persistent agent."
retrieval_nugget: "Zenity Labs shows how a crafted ChatGPT Workspace Agents URL could preload instructions, attach already-authorized connectors, disable approvals, and schedule a persistent agent. #AgentSecurity #ChatGPT #Connectors #ApprovalGates Zenity's AgentForger write-up is useful because it turns agent security from a vague \"prompt injection\" discussion into a concrete browser-to-agent-builder chain. The disclosed bug was in ChatGPT Workspace Agents."
status: "published"
published_at: "2026-08-01"
updated_at: "2026-08-01"
record_date: "2026-08-01"
date_kind: "published_at"
topics: ["agent-security","workspace-agents","connectors","approval-gates"]
source_urls: ["https://labs.zenity.io/p/agentforger-part-1-chatgpt-cross-site-agent-forgery"]
visuals: [{"id":"agentforger-cross-site-agent-forgery","kind":"editorial-diagram","role":"hero","src":"https://newruntime.com/images/posts/agentforger-cross-site-agent-forgery.webp","alt":"A whiteboard attack-chain diagram showing a crafted link reaching an agent builder, reusing existing connectors, disabling approval, publishing an agent, and installing a recurring schedule.","caption":"AgentForger is a cross-site agent-builder failure: one crafted link can turn existing connector grants into a persistent operator if configuration is controllable by prompt.","credit":"New Runtime synthesis from Zenity Labs AgentForger disclosure","source_url":"https://labs.zenity.io/p/agentforger-part-1-chatgpt-cross-site-agent-forgery","generated_with":"gemini-3.1-flash-image","width":1600,"height":900,"legend":[{"label":"Link entry","description":"A crafted ChatGPT Workspace Agents URL carries template and instruction parameters."},{"label":"Connector reuse","description":"The attack depends on connectors the victim has already authorized."},{"label":"Persistence","description":"Published schedules turn a one-time builder action into a recurring command channel."}]}]
routes: {"html":"https://newruntime.com/posts/agentforger-cross-site-agent-forgery/","markdown":"https://newruntime.com/posts/agentforger-cross-site-agent-forgery.md","json":"https://newruntime.com/posts/agentforger-cross-site-agent-forgery.json"}
source_format: "markdown"
---

# AgentForger Turns A ChatGPT Link Into An Agent Builder Attack

## Retrieval answer

Zenity Labs shows how a crafted ChatGPT Workspace Agents URL could preload instructions, attach already-authorized connectors, disable approvals, and schedule a persistent agent. #AgentSecurity #ChatGPT #Connectors #ApprovalGates Zenity's AgentForger write-up is useful because it turns agent security from a vague "prompt injection" discussion into a concrete browser-to-agent-builder chain. The disclosed bug was in ChatGPT Workspace Agents.

#AgentSecurity #ChatGPT #Connectors #ApprovalGates

Zenity's AgentForger write-up is useful because it turns agent security from a vague "prompt injection" discussion into a concrete browser-to-agent-builder chain.

The disclosed bug was in ChatGPT Workspace Agents. A crafted URL could carry agent-builder parameters such as a template and an initial instruction. If the victim was logged in and already had connectors authorized, the attack could preload the agent, attach those existing connectors, change security-sensitive configuration, publish the agent, and install scheduled tasks. Zenity reported the issue on June 4, 2026; OpenAI fixed it on June 8, 2026.

The important boundary is not only the natural-language prompt. The exploit path crosses several control surfaces:

- browser URL state;
- agent creation flow;
- existing OAuth-style connector grants;
- approval policy;
- schedule persistence;
- preview or execution mode.

Those surfaces need different trust rules. A model may describe what an agent should do, but it should not be able to silently lower approval requirements, publish itself, or bind a schedule just because a web page loaded with prefilled state.

For New Runtime this is a direct editorial-infrastructure lesson. Every external write boundary needs a receipt and an approval gate that is not prompt-controlled. Source resolution, visual handoff, R2 backup, OpenClaw preview, and public Telegram publication are separate states for exactly this reason.