One Bad ChatGPT Link Can Create a Rogue AI Agent That Takes Orders Every 5 Minutes

A single tampered ChatGPT link can build and publish an autonomous AI agent under your name, and it will obediently check an attacker’s inbox for new orders every five minutes. That’s not a hypothetical scenario. Security researchers at Zenity Labs just demonstrated exactly how it works, and they’re calling it ‘AgentForger.’

The attack is a vicious twist on an old web problem. Just like a classic cross-site request forgery (CSRF), it starts with a crafted link. But instead of tricking you into one unwanted action, this link silently automates the entire agent-building process in OpenAI’s Workspace Agents. By stuffing malicious instructions into URL parameters, an attacker can guide the Agent Builder to create a ‘TASK Mail Operator’ agent. It connects to your already-authorized apps—Outlook, Gmail, Slack—and immediately disables every approval requirement, setting them to ‘Never ask.’

‘It also created schedules to run every five minutes,’ Zenity explains in their analysis. The agent then checks for emails with ‘TASK’ in the subject line, executes whatever instructions follow, and sends the results right back. The victim sees nothing—no OAuth prompt, no approval dialog—because the agent simply reuses existing permissions. The attacker has just installed persistent command-and-control infrastructure with one click.

OpenAI fixed the specific vulnerability within four days of being notified. But Zenity’s point isn’t about this single bug. It’s that our entire security model is built to catch malware and unauthorized logins. It isn’t ready for an agent that operates under a legitimate user’s identity, uses their approved apps, and follows a hidden schedule. We’ve spent years teaching people not to run strange executables. Nobody taught us to fear a ChatGPT link that builds a silent, persistent digital employee for someone else.