#AgentSecurity #ChatGPT #Connectors #ApprovalGates
Zenity’s AgentForger write-up is useful because it turns agent security from a vague “prompt injection” discussion into a concrete browser-to-agent-builder chain.
The disclosed bug was in ChatGPT Workspace Agents. A crafted URL could carry agent-builder parameters such as a template and an initial instruction. If the victim was logged in and already had connectors authorized, the attack could preload the agent, attach those existing connectors, change security-sensitive configuration, publish the agent, and install scheduled tasks. Zenity reported the issue on June 4, 2026; OpenAI fixed it on June 8, 2026.
The important boundary is not only the natural-language prompt. The exploit path crosses several control surfaces:
- browser URL state;
- agent creation flow;
- existing OAuth-style connector grants;
- approval policy;
- schedule persistence;
- preview or execution mode.
Those surfaces need different trust rules. A model may describe what an agent should do, but it should not be able to silently lower approval requirements, publish itself, or bind a schedule just because a web page loaded with prefilled state.
For New Runtime this is a direct editorial-infrastructure lesson. Every external write boundary needs a receipt and an approval gate that is not prompt-controlled. Source resolution, visual handoff, R2 backup, OpenClaw preview, and public Telegram publication are separate states for exactly this reason.