Critical Security Vulnerability in ChatGPT Workspace Agents

Cybersecurity researchers have discovered a critical security vulnerability in OpenAI's ChatGPT Workspace Agents. This vulnerability, codenamed AgentForger, could allow attackers to secretly create, authorize, and deploy an autonomous AI agent within an organization through a single phishing link. The discovery was published by Zenity Labs, which highlights the potential dangers of this security flaw. According to the researchers, an attacker could gain control over internal systems and steal or manipulate sensitive data by exploiting this vulnerability. OpenAI addressed the security flaw on June 8, 2026.

The company's swift response to the discovery demonstrates the urgency with which such security issues must be addressed, especially at a time when AI technologies are increasingly integrated into businesses. The vulnerability affects how ChatGPT Workspace Agents are authorized. An attacker could create a new agent through a crafted link, which would then operate with the rights of a regular user. This could lead to a massive security incident if companies do not have appropriate security measures in place.

Zenity Labs has published the details of the vulnerability in a report that explains the technical aspects of the flaw. The researchers emphasize that the vulnerability is significant not only for businesses but also for individuals who use ChatGPT in their daily workflows. The discovery of AgentForger is not the first security vulnerability found in AI systems. In recent years, there have been several incidents where vulnerabilities in AI applications were exploited to gain unauthorized access to data. These incidents highlight the need for continuous review and updating of security protocols.

OpenAI has already taken steps to enhance the security of its products. These include regular security audits and the implementation of new security features to prevent potential attacks. Users are encouraged to regularly update their systems and follow security policies. The vulnerability has been registered under the CVE number CVE-2026-1234. This classification allows security researchers and IT administrators to identify the flaw and take appropriate measures.

The discovery of AgentForger has also sparked discussions about the ethical implications of AI technologies. Experts warn that inadequate security measures in AI applications can lead to serious consequences, especially when these technologies are deployed in critical infrastructures. Security research will continue to play a central role in the development and implementation of AI technologies. Researchers and companies must collaborate to ensure that security vulnerabilities are quickly identified and resolved. Continuous training of employees regarding cybersecurity is also crucial to minimize the risk of phishing attacks. The discussion about the security of AI systems is expected to intensify in the coming months, particularly with the increasing prevalence of AI applications across various industries. Companies are urged to take proactive measures to protect their systems and maintain user trust.