OpenAI Agent Builder flaw lets one malicious link spawn rogue AI agent

Zenity Labs identified a critical flaw in OpenAI's Agent Builder that transforms a simple social engineering vector into an autonomous attack tool. The vulnerability, named "AgentForger," works by embedding a malicious prompt into a ChatGPT link. When an employee clicks the link, it triggers the creation of an AI agent that operates with the full identity and access rights of the clicked user. The agent is not merely a one-time execution; instead, it autonomously retrieves updated instructions from the attacker's inbox at five-minute intervals, allowing the attacker to modify the agent's behavior and objectives without further user interaction. The malicious prompt embedded in the link is sophisticated enough to bypass the approval mechanisms that would normally gate agent creation. This combination—stolen identity, inherited access, automated instruction retrieval, and approval bypass—creates a scenario where a single user mistake can establish a persistent, attacker-controlled presence within an organization's systems.

The AgentForger vulnerability represents a new attack surface created by AI agent automation. Unlike traditional phishing attacks that require a one-time user action to succeed, this flaw enables sustained, automated compromise through a single click. The agent's ability to poll the attacker's inbox every five minutes converts a moment of user error into a persistent backdoor, effectively giving the attacker a legitimate identity within the company network. The bypass of approval requirements through malicious prompting suggests that the trust model underlying Agent Builder may not adequately validate agent creation requests even when they originate from within the system.

No comments yet. Be the first to share your thoughts!