{"data":{"id":"4e0166b2-f3ef-4d1a-85c5-a0e073ab8ba3","title":"ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link","summary":"OpenAI's ChatGPT Workspace Agents had a critical vulnerability called AgentForger that allowed attackers to use a single phishing link to secretly create and deploy a rogue AI agent inside a victim's organization. The flaw exploited cross-site request forgery (CSRF, a type of attack where a malicious website tricks your browser into making unwanted requests) by embedding malicious instructions directly in a URL that would automatically execute when a logged-in employee clicked it, giving the attacker's agent access to the victim's connected apps like email and cloud storage without requiring approval.","solution":"OpenAI addressed the issue as of June 8, 2026, following responsible disclosure. Additionally, OpenAI announced it is deprecating the Agent Builder product effective November 30, 2026, and urging users to switch to the Agents SDK.","labels":["security"],"sourceUrl":"https://thehackernews.com/2026/07/chatgpt-agentforger-flaw-could-deploy.html","publishedAt":"2026-07-24T11:53:55.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["prompt_injection"],"issueType":"news","affectedPackages":null,"affectedVendors":["OpenAI"],"affectedVendorsRaw":["OpenAI","ChatGPT","ChatGPT Workspace Agents","Agent Builder"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-07-24T11:53:55.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}