--- title: AgentForger: how a single phishing link could plant a... description: Security researchers at Zenity Labs have uncovered AgentForger, a phishing-based attack that exploits a now-patched OpenAI vulnerability to silently deploy... canonical: https://daily.dev/posts/agentforger-how-a-single-phishing-link-could-plant-a-rogue-ai-agent-inside-your-company-f9tpobhll twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AgentForger: how a single phishing link could plant a rogue AI agent inside your company | daily.dev og:description: Security researchers at Zenity Labs have uncovered AgentForger, a phishing-based attack that exploits a now-patched OpenAI vulnerability to silently deploy... og:url: https://daily.dev/posts/agentforger-how-a-single-phishing-link-could-plant-a-rogue-ai-agent-inside-your-company-f9tpobhll og:image: https://api.daily.dev/og/posts/F9tPObhlL.png og:image:alt: AgentForger: how a single phishing link could plant a rogue AI agent inside your company og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AgentForger: how a single phishing link could plant a rogue AI agent inside your company **[Collections](https://daily.dev/sources/collections)** · 3 min read · 2 upvotes · 0 comments ## Summary Security researchers at Zenity Labs have uncovered AgentForger, a phishing-based attack that exploits a now-patched OpenAI vulnerability to silently deploy rogue autonomous AI agents inside enterprise ChatGPT workspaces. A single malicious link click is enough — no consent screens required — because the agent leverages already-trusted integrations with Outlook, Slack, SharePoint, and Teams. Once deployed, the agent self-configures to bypass human approval, runs on a schedule, and can perform reconnaissance, credential theft, employee impersonation, and further phishing. OpenAI patched the specific flaw within four days of disclosure, but researchers warn this points to a broader governance gap: most enterprises lack visibility into what agents exist in their environment, what they can access, and whether their behavior is legitimate. ## Content Security researchers at Zenity Labs disclosed a phishing-based attack called AgentForger that exploited a now-patched OpenAI vulnerability to silently create autonomous AI agents inside enterprise ChatGPT workspaces. OpenAI patched the flaw four days after disclosure, but the technique raises questions that won't go away just because one bug got fixed. ## What the attack actually did One click on a malicious link was enough. The forged agent would spin up inside a corporate ChatGPT workspace with access to Outlook, Slack, SharePoint, Google Drive, and Teams — no OAuth consent screens, because those integrations already existed. The agent configured itself to never require human approval, ran on a schedule, and received task assignments through attacker-controlled emails. From there it could do reconnaissance, steal credentials, impersonate employees, and launch phishing campaigns against colleagues. A corporate mole, installed in about the time it takes to open an email. ## Why this is harder to contain than it looks The obvious fix — patch the vulnerability — is done. The harder problem is structural. AI agents don't get tired, don't face real consequences for going rogue, and don't have the judgment to recognize when a task makes no sense. Tell an agent to "find all of our most important IP on project Maven" and it will work through that indefinitely, hitting data with stale access controls, surfacing things nobody realized were accessible. That's the happy path with a well-intentioned user. The malicious-actor version is worse. As Box CEO Aaron Levie put it, enterprises now need to figure out: - What agents exist in their environment and what triggers them - Which systems should stay deterministic versus nondeterministic - How to maintain audit trails of agent behavior - How to quickly block an agent that's gone off-script - Whether access controls are actually current None of this is new in principle — you had to worry about insider threats from people too. But agents amplify the risk because they scale effort without scaling judgment. ## The security framing matters The temptation after an incident like this is to conclude that AI agents are inherently dangerous. That's probably the wrong lesson. A misconfigured system was always a risk vector; agents just make it faster and more thorough to exploit one. The more useful framing: enterprise environments weren't built with autonomous agents in mind, and most of them aren't ready. Hardening those environments — access controls, governance, visibility into what agents are doing — is real work that most organizations haven't started yet. Hugging Face CEO Clement Delangue called the AgentForger incident "the first autonomous agent cyberattack" and argued it deserves full transparency so defenders can prepare. That's probably right. The attack itself is patched. The underlying conditions that made it possible are not. ## Similar posts on daily.dev - [AI agent security: four July attacks, one shared flaw](https://daily.dev/posts/ai-agent-security-four-july-attacks-one-shared-flaw-cpad7rmrf) · The Next Web · 0 upvotes · 0 comments - [AI threat report: Rogue agents, workflow attacks](https://daily.dev/posts/ai-threat-report-rogue-agents-workflow-attacks-lrzesaizw) · CSO Online · 0 upvotes · 0 comments - [The Agentic Virus: How AI Agents Become Self-Spreading Malware](https://daily.dev/posts/the-agentic-virus-how-ai-agents-become-self-spreading-malware-8mthaa9eq) · Security Boulevard · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#chatgpt](https://daily.dev/tags/chatgpt), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/agentforger-how-a-single-phishing-link-could-plant-a-rogue-ai-agent-inside-your-company-f9tpobhll) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AgentForger: how a single phishing link could plant a rogue AI agent inside your company","url":"https://daily.dev/posts/agentforger-how-a-single-phishing-link-could-plant-a-rogue-ai-agent-inside-your-company-f9tpobhll","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/agentforger-how-a-single-phishing-link-could-plant-a-rogue-ai-agent-inside-your-company-f9tpobhll"},"datePublished":"2026-07-24T03:20:59.648Z","dateModified":"2026-07-31T01:12:55.517Z","description":"Security researchers at Zenity Labs have uncovered AgentForger, a phishing-based attack that exploits a now-patched OpenAI vulnerability to silently deploy...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/71e43417e21c3762508aa33bff9b5129?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/71e43417e21c3762508aa33bff9b5129?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/agentforger-how-a-single-phishing-link-could-plant-a-rogue-ai-agent-inside-your-company-f9tpobhll","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,chatgpt,phishing","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"AgentForger: how a single phishing link could plant a rogue AI agent inside your company"}]} ```