OpenAI Fixes AgentForger Flaw That Could Let Attackers Control ChatGPT Workspace Agents
Summary
Zenity disclosed AgentForger, a CSRF flaw in ChatGPT Workspace Agents that could let attackers trick a phished, logged-in user into creating an attacker-controlled agent with access to authorized connectors. OpenAI fixed it within three days.
Key points
- Zenity Labs identified and disclosed a tailored cross-site request forgery vulnerability in ChatGPT Agent Builder, naming it AgentForger.
- Researchers say a crafted initialization URL could use an agent template and an initial prompt to make the Builder create an agent with attacker-specified instructions.
- The described attack requires a successful phish, a user logged into ChatGPT with Workspace Agents access, at least one authorized connector, and a click on the weaponized URL.
- The agent could be instructed to take commands from emails with a specified subject prefix and email results to the attacker; Zenity says the agent could be hidden and run without repeated user approval.
- Zenity says potential misuse included searching for sensitive data, harvesting credentials, impersonating the victim, internal phishing, and business email compromise.
- Zenity reported the issue to OpenAI; the article says OpenAI accepted the report within a day and fixed the vulnerability within three days, with disclosure on June 4 and a fix on June 8.
Article Details
- Vulnerability Types
- Cross-site request forgery (CSRF)
- Severity
- Critical
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe agent can send results, including raw values, by email to the attacker.T1071.003 · Mail ProtocolsThe attacker’s emails with a subject beginning with “TASK” provide instructions to the agent, which emails results back.T1114.002 · Remote Email CollectionThe agent checks a connected email account for messages matching the attacker’s instructions.T1204.001 · Malicious LinkThe employee must be socially engineered into clicking the weaponized URL.T1566.002 · Spearphishing LinkThe attack requires phishing an employee with a weaponized URL that launches the agent.
People
Vendors
Products
Agent BuilderZenity explains in two blogs (Part 1 and Part 2) that the vulnerability was in ChatGPT’s Agent Builder allowing an over permissive parameter.ChatGPT Workspace AgentsZenity Labs has found and disclosed a critical vulnerability in OpenAI’s ChatGPT Workspace Agents, which it names AgentForger; a tailored cross-site request forgery (CSRF).