ChatGPT Shared Link Vulnerability Plants Rogue Agents

When Zenity Labs disclosed that a single shared ChatGPT link could silently spin up a malicious agent inside a corporate workspace, most coverage fixated on the click. The click is the least interesting part. The ChatGPT shared link vulnerability that Zenity dubbed AgentForger operates as a deployment channel rather than a one-time prompt injection. It installs a persistent, credential-bearing agent inside a trusted tenant, where it operates indefinitely.

That distinction reframes the threat model for every enterprise running collaborative AI. Prompt injection is transactional: poison the input, extract the output, move on. Agent persistence is an occupation. The attacker's agent does not need to keep breaking in because it never left.

The Threat of Rogue AI Agent Persistence

Security teams have spent years building defenses against prompt injection. They test for malicious instructions hidden in documents, web pages, and tool outputs, and many organizations have invested in prompt injection mitigation controls that filter inputs before they reach the model. Those attacks are real, but they share a structural limitation. They are ephemeral. A successful injection influences one model response, and then the context clears. The attacker must find a new vector for every subsequent request.

Agent persistence breaks that assumption. Zenity's proof of concept showed that the agent created through the shared link did not simply answer a poisoned question. It became a standing entity inside the workspace, configured to monitor the victim's inbox for emails containing "TASK" in the subject line. Each such email became a new assignment: searching company files, collecting sensitive documents, or exfiltrating results back to the attacker. The agent operated on its own schedule, not in response to a single injected prompt.

The gap between these two threat models is structural, not incremental:

This is why rogue AI agent persistence is structurally more dangerous than injection. As AI platforms introduce always-on ChatGPT agents that operate across email, chat, calendars, and file stores, the boundary between an AI assistant and a workforce identity dissolves. An agent that wakes on a schedule, reads corporate mail, and acts through connected SaaS accounts is functionally a privileged employee with system access and no supervisor reviewing its decisions. The rapid expansion of transactional AI agents that sell, message, and execute across enterprise systems means this attack surface is growing, not stabilizing.

Persistence also defeats standard incident response playbooks. There is no malware binary to quarantine and no command-and-control server to block. The rogue agent communicates through the victim's own Outlook inbox and legitimate Slack or Teams connectors, using authenticated sessions that the workspace already trusts. Detection requires behavioral analysis of agent activity, not network signatures.

Weaponizing the ChatGPT Shared Link Vulnerability

The deployment mechanism is what makes AgentForger effective as an enterprise attack vector. Zenity's agent vulnerability research found that ChatGPT's agent builder accepted instructions embedded in the parameters of a standard shared conversation link. When a victim clicked, the builder interpreted those parameters as a configuration manifest and went to work on the attacker's behalf.

The chain ran automatically. The builder wired up the victim's existing connectors, disabled approval prompts, published the new agent, and set it to run on a schedule. The victim saw a chatgpt.com link, visually identical to the ones colleagues share throughout the workday. The builder saw deployment instructions and executed them without asking for confirmation.

Several preconditions had to be met. The victim needed to belong to a workspace where agents were enabled, with permission to create them. Connected apps and actions, including Outlook, Teams, Slack, SharePoint, and Google Drive, had to be allowed by the organization's administrators. In practice, those conditions are routine in any organization that has adopted collaborative AI for daily workflows.

Zenity reported the issue to OpenAI through Bugcrowd on June 4. OpenAI acknowledged the report the next day and removed the vulnerable URL parameter four days later, before public disclosure. The specific exploit path is closed, but the underlying pattern, a trusted sharing feature doubling as a deployment channel, extends well beyond one parameter. Malicious ChatGPT browser extensions have demonstrated similar abuses of the platform's trusted interface, and the same structural risk applies to any AI workspace that lets users share links to agent-configured sessions.

The effectiveness of this vector comes from weaponizing a feature people already trust. Security awareness training teaches users to scrutinize unknown domains and suspicious attachments. A shared ChatGPT link carries the platform's own domain and branding. There is no attachment to scan and no executable to flag. The collaboration feature is the weapon, and it walks through every perimeter the organization has built.

How Lateral Movement Bypasses Workspace Defenses

A stolen OAuth token or a compromised SaaS connector gives an attacker access to one service. A rogue agent does something categorically different: it chains autonomous actions across every connected service in a single session, adapts its behavior based on what it discovers, and spreads its activity over days or weeks through scheduling. Security teams already handle credential abuse. They have not encountered a threat that reasons, plans, and writes new content inside the trust boundary.

Three structural differentiators separate agent-based movement from the credential abuse teams handle daily.

The agent creates content, not just exfiltrates data. Zenity's proof of concept had the installed agent dispatch phishing lures from the victim's own Teams account, so colleagues received messages that appeared to come from a trusted coworker. Detection tools built to flag data leaving the network miss an agent composing calendar invites or chat messages through authenticated connectors. The threat is impersonation at scale, not theft.

The scheduling dimension defeats burst detection. Traditional credential abuse concentrates activity in a short window. A rogue agent configured to run on a schedule spreads its actions across days or weeks. An agent that reads three files on Tuesday, sends two messages on Thursday, and searches chat histories on Sunday looks like a busy employee, not an attacker.

The agent adapts its tasking based on reconnaissance. Zenity's agent monitored the victim's inbox for emails containing "TASK" in the subject line and decided what to do next based on the content it found. It searched chat histories for exposed passwords and API keys, catalogued employees and projects across Outlook, Slack, Teams, calendars, and file repositories, and acted on what it learned. This non-deterministic behavior makes traffic patterns impossible to signature.

This is why traditional lateral movement detection, built around network traversal, port scans, and credential dumps, does not map to agent persistence. Prompt injection filters fail for a related reason: they examine user-submitted input, but the rogue agent receives its instructions through the victim's own email, not through the chat interface. Both control classes were built for threats that live outside the trust boundary.

The Credential and Data Scope Inheritance Flaw

The most consequential aspect of the ChatGPT shared link vulnerability is what the agent receives once it arrives, not how it enters the workspace. The rogue agent does not need to phish passwords or hijack browser sessions. It inherits the credential scope and data access that the workspace already granted to the victim.

If the victim connected Outlook, the agent reads and sends corporate email. If they connected Teams, the agent impersonates them in chats. If they connected SharePoint or Google Drive, the agent searches and exfiltrates files. Every OAuth scope, every API integration, every connected service the victim authorized becomes available to the rogue agent, because the platform derives agent permissions from the creating user's identity.

Zenity noted that the attack disabled approval prompts before publishing the malicious agent. This matters because many organizations rely on human-in-the-loop checkpoints to prevent unauthorized actions. When AgentForger turned those prompts off, the agent gained the ability to act autonomously, bypassing the very guardrail meant to catch exactly this kind of abuse.

Michael Bargury, Zenity's co-founder and CTO, told The Register that the attack creates what amounts to a forged insider: an autonomous agent deployed through a single click, running under the victim's identity with guardrails disabled.

This inheritance model reflects a structural design choice across enterprise AI platforms where agents operate under the creating user's identity and permissions. Research on custom GPT security vulnerabilities has documented how insufficient isolation between agent execution contexts and user data can expose sensitive information through connected tools and actions. The problem compounds when agents inherit broad credential scopes. An agent created by a user with access to finance systems, HR databases, and executive communications simultaneously inherits all of that surface area.

The credential inheritance risk extends beyond AI platforms to the broader enterprise identity ecosystem. The OAuth-based delegation model that lets agents access connected services shares the credential scope problem that exists across most enterprises, where a single delegated token unlocks far more than intended. Credential theft and session hijacking tactics remain relevant here because agent persistence transforms them from manual exploits into automated routines. A rogue agent exercises inherited credentials on a schedule, eliminating the attacker's need to maintain manual access or repeatedly re-authenticate.

ChatGPT Team workspace controls do provide data isolation features that separate workspace content from model training and offer administrative controls over member activity. Those mechanisms address data handling and tenant separation. They do not specifically prevent a rogue agent from exercising inherited connected-app permissions from inside the trusted perimeter.

Mitigating Lateral Persistence in AI Workspaces

The AgentForger patch closed one URL parameter. It did not close the architectural gap. Agents inherit their creator's credential scope, run on schedules the platform does not centrally govern, and execute actions through connectors the workspace already trusts. This is an architecture problem, not a configuration problem, and the controls below address the mechanics that AgentForger exploited.

Restrict Agent Creation Rights

ChatGPT Enterprise administrative controls let administrators decide whether members can create agents and which connectors and actions are available. AgentForger required the victim to hold agent-creation permissions in an enabled workspace. Tightening these defaults so that only designated users can deploy agents shrinks the population susceptible to a link-based deployment attack. The non-obvious corollary: users who need agent creation rights for legitimate work should not hold those rights in the same workspace where they connect sensitive systems like finance databases or executive mail.

Lock Approval Prompts Against Programmatic Disabling

The AgentForger attack succeeded partly because it programmatically turned off approval prompts before publishing. The fix is not simply to enable approvals. It must prevent the platform from allowing agent builders to disable them via configuration. Organizations should verify that any approval mechanism for sensitive actions, including sending messages, accessing files, and executing transactions, cannot be toggled off through agent configuration manifests or URL parameters. If the platform exposes that capability at all, it should be locked behind administrative policy that no agent-level instruction can override.

Audit Inherited Credential Scope

An agent can only inherit what the victim has connected. Audit every user's authorized apps and OAuth scopes, and remove integrations that are no longer needed. A user who connected Google Drive months ago for a one-time task and forgot about it has unnecessarily expanded their agent inheritance surface. Least-privilege credential management limits the blast radius of any rogue agent to only the access actively required. The OAuth-based delegation model that AgentForger exploited means a single stale connector can hand a rogue agent persistent access to an entire SaaS application.

Segment Agent Trust Boundaries

Enterprise AI platforms commonly run all agents within the same trust boundary, giving each agent the full scope of its creating user's access. AI architecture security research underscores the need for structural separation between agent execution contexts and sensitive data. Most major AI platforms do not natively isolate agent execution contexts from the creating user's credential scope, making this an unsolved architectural problem. Agents handling sensitive operations should operate in restricted scopes with independent credentials, not inherited user sessions. Until platforms provide this isolation natively, organizations should segment users by risk tier, ensuring that employees with access to sensitive systems do not hold agent creation permissions in the same workspace where they connect those systems.

Detecting Rogue Agents in Your Workspace

A rogue agent's traffic resembles normal user activity, not malware. Behavioral baselining is the primary detection lever available today. Organizations should profile what legitimate scheduled agents actually do: typical message volumes, file-access windows, connector-usage patterns, and the systems they interact with. General user-behavior analytics fall short because they compare agent actions against human work patterns, which scheduled agents violate by design.

Specific indicators of compromise drawn from the Zenity proof of concept include unexpected scheduled agent activity at off-hours, approval prompts silently disabled before agent publication, anomalous file access across connected repositories outside the user's normal workflow, and agent-initiated messages sent from the victim's account to internal colleagues. Each warrants immediate investigation, because the agent operates under legitimate credentials and will not trigger standard security alerts.

The broader lesson for ChatGPT workspace security is that AI collaboration features require the same scrutiny organizations apply to identity providers, SaaS integrations, and endpoint management. A shared link in an agent-enabled workspace is a deployment channel. Organizations that build trust boundaries around agent persistence now will be better positioned for the next wave of AI security challenges. Those that treat the AgentForger patch as the resolution will discover that the architectural problem outlives any single fix.