Zenity Labs has identified a critical vulnerability in OpenAI's Workspace Agents, allowing attackers to create an autonomous AI agent through a tampered ChatGPT link. The flaw, dubbed 'AgentForger,' enables an attacker to generate an AI agent that operates under a victim's identity, bypassing security controls and executing commands on a recurring schedule. The agent checks an attacker's inbox for new orders every five minutes and carries out tasks using the victim's authorized applications. This attack leverages URL parameters to automate the agent creation process, sidestepping the usual approval steps that protect sensitive actions. Source: thedecoder
The vulnerability exploits the way ChatGPT's Agent Builder processes URL parameters, allowing attackers to inject a prompt that automatically runs without user interaction. By embedding a malicious prompt in a URL, attackers can create an AI agent that integrates with the victim's pre-approved connectors, such as Outlook, Slack, and Google Drive, and disables approval requirements for all actions. The agent is then scheduled to run every five minutes, checking for new commands from the attacker and executing them using the victim's credentials. This method bypasses traditional security measures, as the agent operates within the company's trust boundary and has access to sensitive data through already authorized connections. Source: thedecoder
Zenity Labs highlighted that the attack is a new class of threat targeting agent-based AI systems, building on classic cross-site request forgery (CSRF) techniques but with far greater persistence and access. Unlike traditional CSRF, which triggers a single action, AgentForger creates a fully autonomous agent that runs on a schedule and can access private data through pre-approved connectors. The attack also uses email as a command channel, allowing attackers to issue ongoing instructions and receive results without further user interaction. This highlights the limitations of current security tools in protecting against autonomous agents that operate under legitimate user identities. Source: thedecoder
