The Risks of Autonomous AI Agents

AI agents are increasingly being integrated into business workflows, serving tasks such as managing customer communications or monitoring security vulnerabilities. While these tools offer significant efficiency, their growing presence in corporate environments introduces new attack vectors. Cybersecurity experts have raised concerns about the potential for these systems to be subverted, turning them into tools for data exfiltration or internal disruption.


The AgentForger Vulnerability

Security researchers at Zenity Labs recently uncovered a significant flaw within OpenAI's ChatGPT Agent Builder, the platform used for crafting custom AI assistants. The vulnerability, which the team named "AgentForger", was rooted in a permissive URL parameter that allowed for the injection of arbitrary instructions into the builder tool.


The attack mechanism was relatively straightforward yet dangerous:

  • An attacker crafts a malicious link containing specific instructions.
  • When an unsuspecting victim clicks this link, the instructions are automatically funneled into the Agent Builder.
  • The system executes the malicious configuration immediately, often without requiring further user intervention or providing clear notifications.

Long-Term Threats to Corporate Infrastructure

Because the agent is deployed directly into the victim's workspace, it could potentially perform any action that a legitimate AI agent is authorized to do. This includes accessing sensitive company data or executing unauthorized commands. Moreover, once established, these rogue agents could persist within the infrastructure, operating silently until discovered.


Michael Bargury, co-founder and CTO of Zenity, emphasized the structural nature of this security gap:

«This is an agent trust failure, and existing security controls were never built to see it.»

Rapid Remediation by OpenAI

The research team shared their findings with OpenAI in early June 2026. According to the report, the company addressed the vulnerability within a few days by removing the problematic URL parameter that facilitated the exploit. Currently, there is no evidence to suggest that this security gap was exploited by threat actors prior to its discovery.