OpenAI Patches ChatGPT Workspace Agent Vulnerability

SecurityWeek reported that the vulnerable Agent Builder accepted instructions embedded in an initialization URL. Zenity's researchers identified two relevant parameters: one selecting an agent template and initial_assistant_prompt, which supplied instructions automatically submitted to the builder.

According to SecurityWeek, an attacker could use those parameters to direct the builder to connect to services already authorized by the employee, turn off approval prompts, publish the agent, and run it on a schedule. The attack depended on several conditions:

• •The target employee had to be logged into ChatGPT and have access to Workspace Agents.
• •The employee needed permission to create agents in the relevant workspace.
• •An enterprise connector, such as Gmail or Outlook, had to be authorized already.
• •Workspace administrators had to permit the connected applications and actions involved.

The Register reported that, in Zenity's proof of concept, the agent monitored the employee's inbox for messages from an attacker with "TASK" in the subject line. Those messages could then direct the agent to search files, collect documents, send messages through connected services, or email results externally, subject to the permissions available through the victim's account and the workspace's controls.

Zenity wrote that the created agent could inherit a real employee's identity and access while appearing as legitimate activity. SecurityWeek reported that the approach could avoid a new OAuth consent screen when the employee had already connected the relevant service, because the malicious agent reused existing authorized connectors.

This distinction matters for AI security operations. Conventional phishing defenses often focus on credential theft, malware delivery, or browser-session compromise. Agentic workflows introduce another failure mode: a user action can authorize the creation of a durable software actor that continues to invoke enterprise tools through preexisting permissions. In comparable systems, controls over agent creation, connector scope, scheduled execution, and human approval can be as consequential as controls over initial authentication.

Zenity said OpenAI fixed the underlying flaw quickly and that it had found no evidence of exploitation in the wild. The available reports do not specify the technical details of the patch or whether organizations need to take additional remediation steps for agents created before the fix.

The reported preconditions narrow the immediate exposure, but the vulnerability illustrates how AI-agent builders can combine phishing, delegated identity, connector access, and autonomous execution. Security teams operating enterprise agent platforms can inventory agents and their connected applications, review which actions can execute without approval, and monitor for unusual scheduled tasks or email-triggered workflows.

More broadly, the incident places emphasis on lifecycle controls rather than only prompt filtering. In systems where agents can be created from links or templates, secure defaults for URL parameters, agent publication, approvals, and delegated credentials help reduce the chance that a single click creates a persistent, privileged workflow.