AgentForger Vulnerability in ChatGPT Workspace Agents Enabled Malicious AI Deployment via Single Phishing Link
A vulnerability in ChatGPT Workspace Agents allowed attackers to create and deploy a malicious AI agent inside an organization from a single phishing link. The flaw, dubbed AgentForger, was corrected by OpenAI on 8 June 2026.
The attack exploited a permissive parameter in the Agent Builder that could receive instructions directly through the URL. When an authenticated user opened the prepared address, the command was sent and executed automatically without any additional confirmation step.
For the attack to succeed, the victim needed access to Workspace Agents and at least one pre-authorized enterprise connector. Supported connectors included Outlook, Gmail, Google Drive, Slack, Teams, and Google Calendar.
Attack Flow
- The malicious prompt instructed the platform to create a new agent.
- The agent connected to all available enterprise applications.
- Approval requests were disabled.
- The agent was published and scheduled for immediate and recurring execution.
In the proof-of-concept demonstration, the agent searched for emails sent by the attacker with subjects beginning with “TASK”. Each such message served as a new command, allowing the agent to perform tasks and return results to an address controlled by the attacker.
The vulnerability was reported on 4 June and resolved four days later by removing the vulnerable parameter. No evidence of real-world exploitation has been found. Organizations are advised to review published agents, connected applications, scheduled tasks, and any settings that bypass human approval.
Related articles
AI Coding Tools Under Fire: Grok Build Uploads Entire Git Histories, Claude Code Suspected of Silent Transfers
Security researcher cereblab uncovered that Grok Build 0.2.93 establishes separate HTTPS channels to exfiltrate full Git repositories, resulting in a 27800-fold traffic discrepancy between task context and storage uploads to Google Cloud Storage buckets. The tool ignores user instructions such as "do not read" and decouples the improve_model_enabled client switch from the server-controlled trace_upload_enabled flag, allowing continued uploads even when privacy settings are disabled. Similar concerns emerged around Claude Code, which maintains undisclosed WebSocket connections that transmit file paths, dependency trees, and code metadata without user awareness or audit logs. Comparative traffic audits showed that Codex and Gemini produced no anomalous outbound activity, while Grok Build and Claude Code were the only tools confirmed to perform data transfers beyond user authorization. The incidents highlight systemic issues including server-side remote control of client behavior, lack of third-party audits for closed-source binaries, and the conflict between model training data needs and user data sovereignty. Experts recommend zero-trust measures such as network blocking, Docker sandboxing without mounting .git directories, git filter-repo sanitization, and preference for auditable open-source alternatives like Continue.dev or locally deployed Ollama models.
PentesterFlow Launches Open-Source AI CLI Tool for Penetration Testers and Bug Bounty Hunters
PentesterFlow is a new open-source, human-in-the-loop AI command-line tool designed specifically for penetration testers and bug bounty hunters. It automates the full workflow from reconnaissance to report generation while requiring explicit analyst approval before executing sensitive commands. The tool addresses common issues in agentic AI security tools such as hallucinations, weak context retention, and poor tool integration by incorporating built-in pentesting skills and evidence-based vulnerability confirmation. It supports connections to local or hosted LLMs including Ollama, Gemini, Groq, and others, and features continuous local learning that stores user preferences and lessons without retraining models. A key differentiator is its integration with Burp Suite and a permission-based execution model that includes a YOLO mode for isolated environments. The project positions itself as a transparent alternative to fully autonomous tools like PentAGI and PentestGPT.
Optimizing Cybersecurity Content for LLMs: How Sites Can Enter Generative AI Answers
Search engines and AI services like ChatGPT, Gemini, Perplexity, Copilot and Google AI Overviews increasingly deliver synthesized answers instead of link lists. For cybersecurity publishers this changes competition because high traditional rankings no longer guarantee visibility or accurate citation. The article explains GEO, AEO and LLMO practices, shows how material moves through indexing, fragment selection and summarization stages, and stresses the need for self-contained facts that survive extraction and paraphrasing. It provides concrete writing frameworks for vulnerability reports, including required fields such as CVE identifiers, affected versions, attack conditions and real-world exploitation evidence. Technical requirements cover correct robots.txt handling for Googlebot, OAI-SearchBot, GPTBot and Bingbot plus the use of IndexNow for rapid updates. The piece also warns about poisoning risks, prompt injection and slopsquatting attacks that can feed false data into generative systems.
LangGraph Architecture Combines Hybrid RAG with YARA and Sigma Engines for Streaming Log Analysis
A new architectural pattern integrates LangGraph with a hybrid RAG system and deterministic signature engines to process large volumes of unstructured cybersecurity logs efficiently. The pipeline uses Vector for chunking logs into 250-line segments with 20-line overlap, Kafka for streaming, and an 8-node asynchronous DAG that runs AI and rule-based branches in parallel. Agent 1 groups events and generates hypotheses, while a hybrid RAG module performs query reformulation, vector plus BM25 search with 0.6/0.4 weighting, and LLM re-ranking against a translated MITRE ATT&CK knowledge base stored in ChromaDB. Parallel YARA and Sigma engines scan parsed logs using custom text-based rule implementations, with automatic YARA rule generation triggered when coverage gaps are detected. Final aggregation occurs in Agent 3, which validates findings, deduplicates confirmed incidents, and routes unconfirmed events for manual review while storing reports in PostgreSQL. Tested on a 43-minute synthetic dataset containing 38 MITRE techniques, the system achieved 85.7% precision and 78.9% recall at 3.5 lines per second using Gemini 2.5 Flash.