PERMISSION/PROTOCOL
Back to incident tracker

2026-07-23

HighPrimary

AgentForger: CSRF Phishing Link Silently Deploys Rogue AI Agent inside ChatGPT Workspaces and Disables Approval Gates

Analysis of the AgentForger exploit by Zenity Labs, where CSRF phishing silently deploys rogue AI agents with internal approval gates disabled.

ChatGPT WorkspaceGovernance bypassCross-Site Request Forgery and Permission BypassChatGPT Enterprise / ChatGPT Workspace cloud environment

What happened

A victim clicks a link, initiating a hidden form submission that triggers ChatGPT Agent Builder to instantiate a rogue agent with Microsoft Graph permissions.

Why it matters

Persistent, unauthorized access to enterprise Outlook mailboxes, SharePoint files, and internal Slack communications.

Missing authorization check

Altering approval gate settings must require an out-of-band, physically-signed confirmation token from an administrator's security key.

Would PP block it?

Even if the rogue agent updates its ChatGPT Workspace configuration to disable its internal 'always ask' setting, it cannot bypass PP's Tool-Call Gate. PP's gate sits entirely outside the agent's workspace environment, intercepting all state-modifying actions at the integration proxies and requiring an external, cryptographically-signed authorization receipt. Since the agent cannot self-sign or bypass this external gate, the attack is stopped.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-06-08

    OpenAI deploy patches protecting the Workspace creation endpoints after responsible disclosure.

  2. 2026-07-23

    Zenity Labs publicizes AgentForger, demonstrating permanent human-approval-bypass execution paths.

Technical breakdown

  • The victim clicks a link which posts a payload to OpenAI's ChatGPT Agent Builder endpoint.
  • The server processes the request, deploying an agent and binding it to the victim's active Microsoft Graph API tokens.
  • The deployed agent launches and immediately invokes an internal workspace config API, changing `approval_policy` from 'always ask' to 'never ask'.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Tool-Call Gate, enterprise email/slack proxy boundaries
Still needs
PP does not block the initial registration of the agent within the OpenAI cloud workspace.
Receipt required for
Reading enterprise emails, sharing internal documents, or modifying workspace approval settings

PP's authorization receipts are external to the agent's own workspace configurations and cannot be toggled off by the agent.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop