Security researchers have uncovered a critical weakness in how OpenAI manages agent workspace invitations that could let attackers plant malicious AI agents inside corporate environments using nothing more than a deceptive link.
The flaw, named AgentForger, resides in how ChatGPT handles agent workspace invitations. OpenAI’s platform allows users to create and share collaborative agents that can access files, write code, and interact with connected services. Researchers discovered that the invitation mechanism lacks proper origin validation, enabling attackers to forge workspace agent invitations that appear legitimate.
An attacker who crafts a malicious invitation link and convinces a victim to click it can deploy a rogue agent with the same permissions the victim has granted to legitimate workspace agents. The rogue agent can then read sensitive files, execute code in the workspace environment, and potentially pivot to connected third-party services. The attack works because the invitation system trusts certain metadata that can be manipulated before the link is rendered to the recipient.
OpenAI has been notified and is developing a fix. Organizations using ChatGPT workspace agents should review their current agent inventory, verify all active agents against known deployment sources, and implement strict access controls for agent invitations. Until a patch is available, security teams should treat unsolicited agent invitations with the same caution as suspicious email attachments or unrecognized login prompts.
