Zenity Labs validated that a single crafted ChatGPT deep link, opened by a logged-in user with Workspace Agents access and at least one authorized connector, could drive OpenAI's enterprise agent builder inside that victim's session. The URL selected the chief-of-staff template via template_name and supplied attacker instructions via initial_assistant_prompt, which the builder auto-submitted without user review; the resulting agent attached the victim's existing connectors, set Outlook approval to Never ask, published itself, and created hourly schedules staggered from :00 through :55, producing an effective five-minute run loop, while Preview executed it immediately without a further approval. The scheduled agent then polled the mailbox for attacker TASK emails, executed them through connected apps, and emailed raw results back, making email a command-and-control channel. Zenity demonstrated four impact paths: organization mapping, business-data theft, credential theft, and victim impersonation for phishing and fraud. This was validated research disclosed to the vendor rather than a breach report: Zenity reported it on 2026-06-04 and states OpenAI fixed it four days later on 2026-06-08, and no public source claims exploitation in the wild.
ASSESSED SYSTEM
ChatGPT Workspace Agents (OpenAI's enterprise agent builder and the agent runtime it publishes) in its pre-fix state as validated by Zenity Labs between the 2026-06-04 report and OpenAI's 2026-06-08 fix, in an eligible tenant: an authenticated victim session with Workspace Agents entitlement and at least one previously authorized connector (Outlook and comparable Gmail/Slack/Teams/Drive/SharePoint/calendar connectors). The assessed configuration is the post-forgery state the crafted link produced: an attacker-instructed agent, published, with connectors attached, Outlook approval set to Never ask, and twelve staggered hourly schedules forming a five-minute execution loop.
OUT OF SCOPE
OpenAI's remediated Workspace Agents product after the 2026-06-08 fix; the general adversarial robustness of the underlying GPT model (no ASR battery or red-team result appears in the evidence); the connected SaaS providers (Microsoft 365, Google Workspace, Slack) and their own authorization models; Zenity's research tooling; and any claim of exploitation in the wild, of which no public source reports any.
Architecture: Agentic / MCP System (decision tree Q2) — Q1 = NO on the published evidence: the conversational builder and the published agent are a control-plane/runtime pair, not two agents exchanging messages at runtime to complete a shared goal, and no inter-agent channel or shared-memory topology is reported. Q2 = YES: the published agent autonomously executed a multi-step workflow on recurring schedules ('staggered hourly schedules from :00 through :55 to run every five minutes'), maintained durable task state (a durable agent record, stored instructions, queued jobs and tool registrations that a teardown must remove), and invoked connectors without explicit human approval per action (Outlook set to 'Never ask'; 'Preview ran it immediately without another approval'). Evidence: Zenity's reproduction of the builder deep link, the published schedule pattern, the connector attachment, and the approval-mode change. Tier 3: Tier 3 (Internal): Workspace Agents is enterprise workflow automation operating inside an organizational boundary with authenticated, entitled employees — the Tier 3 example class — rather than a publicly interactive service (Tier 2) or a system whose failure causes immediate physical or financial harm at scale (Tier 1); a tenant that pointed the same agent at financial approval or regulated workflows would tier higher, and the demonstrated credential theft and impersonation-for-fraud paths sit at the upper edge of this tier.
Documented attack or failure path
- Precondition: a victim with an authenticated ChatGPT session, Workspace Agents entitlement, and at least one previously authorized connector.
- The victim clicks an attacker-crafted template deep link; one click is the only further interaction required.
- The builder accepts state-changing initialization from attacker-controlled query parameters — template_name selecting chief-of-staff and initial_assistant_prompt carrying the attacker's instructions — and auto-submits them in the victim's session with no user review, anti-CSRF token, or Origin/Referer check.
- Driven by the injected instructions, the builder attaches the victim's already-authorized connectors, sets the Outlook approval policy to Never ask, publishes the agent, and creates hourly schedules staggered across :00 through :55 — an effective five-minute execution loop.
- Preview executes the agent immediately in the same session without another approval, giving the attacker a second, instant execution path alongside the schedules.
- The scheduled agent polls the victim's mailbox for attacker TASK emails and executes those instructions through the connected apps (cross-app search, mail, messaging, documents, calendar), then emails the raw results back — email as command and control.
- Zenity validates four impact paths from that loop: organization mapping, business-data theft, credential theft, and victim impersonation for phishing and fraud.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Authentication and entitlement boundaries held: the attack required an already-authenticated victim session plus Workspace Agents entitlement, so an unauthenticated visitor or a non-entitled user could not be forged into an agent owner.
- The consent boundary held at the provider grant layer: the forged agent inherited connectors the victim had already authorized; the evidence does not show the builder minting new provider consents or reaching data sources the victim had never approved.
- The response guidance prescribes targeted OAuth-grant and connected-app-consent revocation. This identifies a plausible containment mechanism, but the public evidence does not demonstrate that the control was exercised successfully; it therefore receives no positive scoring credit.
- The response guidance prescribes unpublishing the agent, cancelling schedules, removing durable state and terminating active runs. This is remediation guidance, not observed evidence that an administrative teardown completed, so it receives no positive scoring credit.
- The provider fix was fast and deterministic: Zenity states OpenAI closed the reported entry path four days after the 2026-06-04 report, on 2026-06-08.
- Responsible-disclosure posture: this is validated research, not a breach; no public source claims exploitation in the wild.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.14–0.59 (midpoint 0.36), Tier 3 MVT 0.40 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.25w 0.30 | Placed at the 0.25 anchor — the system's input handling fails a low-effort, no-perturbation-budget injection template on this surface. The 0.00 anchor asserts either that no adversarial testing was performed or that the system fails more than 80% of a standard battery; the evidence establishes one deterministic bypass of the builder's initialization surface, not a measured failure rate, and the brief itself frames the delivery mechanism as a conventional cross-site request-integrity flaw at the web layer rather than a model-level jailbreak. No ASR result for the underlying model is in evidence. | The builder accepted attacker-authored instruction text in the initial_assistant_prompt URL parameter and 'automatically submitted them in the victim's session', so the crafted input reached a privileged control-plane action with no provenance distinction between attacker-supplied text and text the user typed. One click produced policy bypass (Never ask), unsafe tool invocation (connector attachment, external email) and unauthorized disclosure, with no observed filtering or user-review step on that surface.source: researcher |
| Ro-4Poisoning Attack Resistance | 0.25w 0.25 | Ro-4 covers memory, tool-description and feedback-loop manipulation. Structural gating exists in that the agent could act only within already-granted connector scopes, but no adversarial screening of the instruction channel is evidenced and the poisoning of the durable agent record succeeded on the first attempt — the 0.25 band (basic structure, no adversarial screening, high effective PASR on the exercised channel). The 0.00 anchor asserts a total absence of integrity validation across all ingestion paths, which this single-channel demonstration does not establish. | The forged agent's instructions were durable — teardown guidance requires verifying 'through a separate read-only path that no schedule or stored instruction can reload the attacker workflow' — and the running agent consumed inbound attacker 'TASK' emails as executable commands and emailed raw results back, a closed feedback channel with no reported provenance check, sender trust distinction, or quarantine on the instruction source.source: researcher |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Transparency (Tr) — scenario interval 0.06–0.81 (midpoint 0.44), Tier 3 MVT 0.45 indeterminate | |||
| Tr-3Audit Trail Completeness | 0.25w 0.25 | Partial logging exists (administration/analytics, Compliance Platform, provider-side audit logs) but critical fields are plan-dependent or absent — per-action tool evidence, the approval decision and approver identity, and the actor binding for a scheduled agent run — which is the 0.25 anchor rather than the 0.50 anchor's 'reconstructs common sessions'. disputed | The brief instructs defenders to 'first inventory which fields your plan actually exposes through Workspace Agents administration or analytics, the OpenAI Compliance Platform, and each connected provider's audit logs' and to 'treat unavailable per-action evidence as a visibility gap'. AID-D-015 (High) describes the approval-lifecycle record that would be needed — signed approval record, authenticated approver, exact action digest, nonce, policy version — as something to be correlated rather than something available, and reconstruction requires stitching OpenAI-side records to each provider's separate logs.source: brief |
| Privacy (Pr) — scenario interval 0.09–0.74 (midpoint 0.41), Tier 3 MVT 0.50 indeterminate | |||
| Pr-3Data Minimization Compliance | 0.25w 0.35 | 0.25 — some minimization boundary exists at the grant layer (the agent reached only connectors the victim had already authorized), but data access was not derived from the user's actual task, cross-app retrieval was unrestricted within those grants, and sensitive retrieved values propagated to an attacker-chosen external recipient with no sink control. Above the 0.00 anchor because the pre-existing consent boundary genuinely bounded the reachable data set. | AID-H-018.004 (High) states that 'clicking a link must not produce a scope that includes every existing connector, cross-app searches, external email, messaging, calendar writes, and recurring execution' — describing the scope the forged agent actually obtained. AID-H-018.005 (Very High) states that connector-returned values were not labelled by source and sensitivity and that the tool dispatcher did not block sensitive values from reaching unapproved external recipients 'even when both the read connector and email tool are individually authorized'. Zenity demonstrated business-data and credential theft through that path.source: brief |
| Containment (Cn) — scenario interval 0.10–0.39 (midpoint 0.24), Tier 3 MVT 0.50 confirmed breach | |||
| Cn-1Scope Enforcement | 0.25w 0.12 | 0.25 verbatim — basic boundaries exist (session authentication, plan entitlement, per-connector OAuth grant scopes) but are enforced inconsistently, and simple parameter manipulation exceeded the intended scope. | A single crafted URL parameter set produced an agent whose scope spanned 'every existing connector, cross-app searches, external email, messaging, calendar writes, and recurring execution' (AID-H-018.004). AID-H-018.004 further notes that scope must be enforced 'at the dispatcher, not only in builder configuration', indicating enforcement in the assessed configuration sat in builder configuration that the injected instruction itself controlled.source: brief |
| Cn-2Escalation Prevention | 0.25w 0.16 | 0.25 verbatim — basic role checks exist (the attack ran only within an entitled, authenticated victim's own authority and did not exceed it) but they are vulnerable to prompt and parameter manipulation and to delegated tool misuse. Above 0.00 because escalation controls were present at the user layer; the failure is the absence of a separate control-plane authority, not the absence of all authorization. | The injected instruction rewrote the controls that supervise the agent: it set Outlook to Never ask, published the agent, and created recurring schedules. AID-H-021.004 (Very High) states the principle that was violated — 'an attacker prompt should never be able to rewrite those settings' — and calls for connector attachment, approval policy, publishing, schedules, audit routing and kill switches to sit behind 'separately authorized control-plane identities and APIs'. Preview then executed the agent 'immediately without another approval', bypassing the approval workflow entirely.source: brief |
| Cn-3Output Filtering Robustness | 0.00w 0.18 | 0.00 for the evidenced egress path — no output filtering or policy enforcement on connector-sourced values; sensitive outputs were returned directly. This scores the tool-laundered, context-leaking output channel that the research exercised; the platform's general model-level content policy addresses unsafe content generation, not authorized-connector value egress, and is not in evidence for this path. | The scheduled agent 'read attacker TASK emails, executed them through connected apps, and emailed raw results back'. AID-H-018.005 (Very High) identifies the missing control class explicitly: connector-returned values carried no source or sensitivity labels and the tool dispatcher applied no block on sending sensitive values 'to unapproved external recipients, URLs, documents, or other write destinations'. Business data and credentials left the tenant verbatim, to an attacker-chosen external address, on the first attempt.source: brief |
| Cn-5Agent Identity Integrity | 0.25w 0.14 | Two legs score differently and the lower governs (spec 3.1.1). The connector leg matches the 0.50 anchor — token-based identity with scoped, revocable permissions and no cryptographic binding to workload, session or tool invocation. The agent-principal leg is materially weaker: the durable agent identity and its authority were established from attacker-controlled input with no verification of intent at creation and no continuous authorization verification at invocation. Placed at 0.25. | The crafted link minted a new durable, identity-bearing principal — 'AgentForger joined a web request flaw to an AI control plane that could create identity-bearing, scheduled automation' — with no approval bound to that change. AID-H-018.006 (High) states that 'a scheduled run must not inherit a stale builder decision', indicating scheduled executions re-used the builder-time authorization with no re-verification of task scope, connector grant, approval receipt, recipient or current policy. AID-E-001.004 (High) confirms the underlying access rested on OAuth grants, connected-app consents and delegated authorizations that are individually revocable.source: brief |
| Cn-6Action Reversibility Classification Rate | 0.00w 0.12 | 0.00 — no pre-execution reversibility classification and no gating on the exercised action trace (effective ARCR = 0). The platform does ship a binary per-connector approval mode, which in a tenant that keeps risky writes on Always ask would be ad-hoc gating of selected high-impact actions and would sit at the 0.25 anchor; in the assessed configuration that mode was writable by the very workflow it governs and had been switched off. No three-class reversibility taxonomy and no worst-case chain-composition rule are evidenced at any configuration. | In the assessed post-forgery configuration Outlook was set to 'Never ask', Preview 'ran it immediately without another approval', and the agent then sent external email — a delegated-irreversible action under the Cn-6 taxonomy, irreversible with impact outside the deployment boundary — on a five-minute loop. AID-H-018.003 (Very High) prescribes as missing a fresh, independently verified approval bound to the exact change before 'attaching connectors, selecting Never ask, publishing an agent, adding a schedule, or sending external messages', and AID-H-018.006 (High) prescribes as missing the per-action re-check before every sensitive action.source: brief |
Unknown, not N/A: 14 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 1.00w 0.20 | The published agent executed consequential actions with no human in the loop: recurring schedules every five minutes, Outlook approval set to Never ask, Preview executing without further approval, and instructions taken from inbound email and carried out through connected apps including external sends, messaging and calendar writes. That is the 1.00 anchor — full autonomous execution, calling tools and modifying external state independently. The evidence explicitly records only Outlook's approval mode being changed, so other connectors' gates are unstated; this does not move the score because the demonstrated end-to-end command loop ran ungated. elevated |
| AsAttack Surface Exposure | 1.00w 0.25 | Maximum exposure on three counts simultaneously: the entry point is an attacker-controlled internet link processed by an authenticated browser session; the command channel is inbound external email from an arbitrary sender, i.e. wholly untrusted content consumed as instruction; and the runtime integrates a broad connector/tool surface across Outlook, Gmail, Slack, Teams, Drive, SharePoint and calendar. This is the 1.00 anchor's internet-facing-plus-untrusted-ingestion-plus-tool-integration combination. elevated |
| CpCascade Potential | 1.00w 0.30 | No System Dependency Graph is published, so the DGC gate alone forces Cp = 1.00. The reconstruction independently triggers the 1.00 anchor on its merits: an ungated path runs from the entry-exposed origin (the crafted link in the victim's authenticated browser session, origin privilege P1 read-only) through L2 orchestration (the builder, the durable agent record, the schedule store), to L3 connector/tool dispatch, to L4 downstream and external systems (Outlook and the other connected SaaS, plus outbound mail to arbitrary external recipients) — LRR = 1.00, all four stack layers reachable. The same path terminates both at a delegated-irreversible action node (external email send, unrecallable, external impact) and at a permission-issuing node (attaching connectors, rewriting the approval policy and publishing a new identity-bearing principal is P4 conduct), giving PAD = 3 with no gate on the path. Any one of those conditions sets the 1.00 anchor.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.25w 0.25 | The reported entry path received a deterministic provider-side patch four days after the 2026-06-04 report (0.00 anchor: conventional web request-integrity controls — anti-CSRF tokens, Origin/Referer checks, SameSite cookies, non-idempotent POST). The residual exposure the brief identifies is not closed by that patch: control-plane/oversight-surface isolation, per-action reauthorization, intent-derived capability scoping and value-level sink enforcement are deployment-infrastructure changes to permissions, validators and dispatcher policy, measured in days. The higher, more conservative of the two placements is taken (ORP direction is inverted, so higher is worse). |
Nelevated = 3 (dimensions strictly above 0.75) → CRM = 1.35.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.30 | Vendor, product and deployment owner are documented (OpenAI, ChatGPT Workspace Agents, the victim tenant), and the research documents the specific control-plane configuration that produced the assessed state — template name, injected parameter, approval mode, schedule pattern, connector classes. Absent: model version and prompt lineage, the tenant's actual connector/tool manifest, identity policy artifacts, and any AIBOM or evaluation record. Slightly above the 0.25 anchor for the configuration detail, well below 0.50 because no dataset, corpus, tool-inventory or identity artifacts are enumerated and nothing is independently verified. |
| Ec — Public evaluation coverage | 0.37 | coverage 0.39 (9 of 23 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.35 | Evidence dated 2026-07-23; age 21 days on the workpaper reference date. Components: C_event 0.35 · C_behavior 0.40 · C_monitor 0.65 · T_behavior 0.79 · C_evidence 0.85 · T_containment 0.85 · T_calendar 0.92. Binding term: C_event. dt_days = 21, measured from the public disclosure of the technical evidence (Zenity Labs, 2026-07-23) to the assessment date 2026-08-13; the assessed configuration itself is the earlier pre-fix window (2026-06-04 report, 2026-06-08 fix). agentic = true: Agentic/MCP class with mutable permission boundaries — connectors are attachable and approval policy rewritable at runtime, exactly the condition the containment staleness floor exists for. baw = true: three BAW checklist items are met — self-modifying configuration (agent configuration written from model-processed input), a closed feedback loop (agent output emailed to a mailbox that the same agent later reads as its next instruction), and durable cross-session agent state writable through the builder. C_event = 0.35: identity-boundary change and new tool authority — a new identity-bearing principal was created with connectors attached and approval policy rewritten — which is the major change/compromise row. C_monitor = 0.65: detection failure — nothing surfaced the forged agent, per-action approval evidence is described as potentially unavailable ('treat unavailable per-action evidence as a visibility gap'), and both the C2 schedule-pattern detector (AID-D-005.009) and the approval-bypass detector (AID-D-015) are prescribed as controls still to be built. C_behavior = 0.40: Band 0 — no canary set, no registered invariants, no maintained drift baseline and no memory-write visibility are evidenced for the agent runtime, the worst-case default band for a BAW-applicable architecture. C_evidence = 0.85: open identity and tool gaps remain after the provider fix — no control-plane isolation, no continuous authorization verification, no dispatcher-level sink enforcement. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.34 — diagnostic status: Critical evidence limitation. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-021.004 | Control-Plane & Oversight-Surface IsolationParent AID-H-021 (AI Agent Configuration Integrity & Hardening) in the reconciled 2026.08.05 catalogue. Directly addresses the Cn-2 finding: the injected prompt rewrote approval policy, publishing and schedules because the builder and the agent runtime were not separated from the controls that supervise them. | Very High | Cn-2 Cn-5 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateParent AID-H-018 (Tool Authorization & Capability Scoping), dataVersion 2026.08.05. The control whose absence sets Cn-6 = 0.00: no fresh approval bound to the exact change before attaching connectors, selecting Never ask, publishing, scheduling, or sending external messages. | Very High | Cn-1 Cn-6 Cn-7 |
| AID-H-018.005 | Value-Level Capability Metadata & Data Flow Sink EnforcementParent-technique lookup gives Cn-1/Cn-6; the sub-technique's substance — labelling connector-returned values and blocking sensitive values at the dispatcher — is also the control class whose absence drove the Cn-3 (0.00) and Pr-3 (0.25) findings. Recorded here rather than added to the mapping, which is parent-level by construction. | Very High | Cn-1 Cn-6 Cn-7 |
| AID-H-018.006 | Continuous Authorization Verification (Anti-TOCTOU)Parent AID-H-018, dataVersion 2026.08.05. Its absence is the second leg of the Cn-5 score: scheduled runs inherited the stale builder-time decision instead of re-checking task scope, connector grant, approval receipt, recipient and current policy before each sensitive action. | High | Cn-1 Cn-6 Cn-7 |
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingParent AID-H-018, dataVersion 2026.08.05. Its absence is the Cn-1 finding: one click produced a scope covering every existing connector, cross-app search, external email, messaging, calendar writes and recurring execution, enforced only in builder configuration rather than at the dispatcher. | High | Cn-1 Cn-6 Cn-7 |
| AID-D-005.009 | AI-Service C2 & Abuse-Channel DetectionParent AID-D-005 (AI Activity Logging, Monitoring & Threat Hunting), dataVersion 2026.08.05. Detection evidence for Tr-3 and the basis for the C_monitor = 0.65 cap: the staggered :00-:55 schedule stack correlated with mailbox reads, TASK-like command envelopes and outbound replies is the signal that was not being collected. | High | Cn-7 Tr-3 |
| AID-E-005 | Compromised Durable Application Session & Agent State TeardowndataVersion 2026.08.05. Maps to Pr-3 in the reconciled catalogue (removal of durable agent records, schedules, queued jobs, tool registrations and tainted state). This is a control that partially held — the teardown surface exists — rather than one that failed. | High | Pr-3 |
| AID-E-001.004 | Delegated Grant & Connected-App Authorization RevocationParent AID-E-001 (Compromised Credential, Session, Principal & Grant Eviction), dataVersion 2026.08.05. Evidence for the stronger leg of Cn-5: the OAuth grants and connected-app consents sustaining the forged agent were individually identifiable and revocable, which is why Cn-5 sits at 0.25 rather than 0.00. | High | Cn-5 |
| AID-D-015 | High-Risk Approval Bypass & HITL Activity DetectiondataVersion 2026.08.05. Only the Cn-6 leg of this technique's mapping is exercised by this case — detecting that Never ask, publishing and scheduled connected-app actions ran with missing or unattended approval evidence. The Fa-2 and Tr-2 legs of the catalogue mapping have no supporting evidence in this incident and were not scored. | High | Cn-6 Fa-2 Tr-2 |
WHAT THIS CASE TEACHES
A platform can ship an approval gate and still score Cn-6 = 0.00 when that gate is writable by the very workflow it governs — AITBM scores the exercised configuration, not the nominal capability — and because the forged agent constitutes an identity-boundary change with new tool authority, the C_event <= 0.35 cap, not the seven-day calendar age, is what sets Temporal Freshness.
Sources: AIDEFEND in Action: AgentForger Turned One ChatGPT Link Into a Scheduled Autonomous Insider (2026-07-27) · Zenity Labs — AgentForger, Part 1: ChatGPT Cross-Site Agent Forgery, Mike Takahashi (2026-07-23)