One shared ChatGPT link is enough to plant a rogue AI agent in your company

A shared ChatGPT link is no longer just a way to forward a good prompt. Zenity Labs disclosed Wednesday, with independent pickup from The Register, that a single crafted link can pivot a logged-in ChatGPT session into an autonomous program that reads chats, calls connected tools, and exfiltrates data, all without the user doing anything past the click. If your company uses shared ChatGPT links today, the security team owes you a specific audit by Friday.

Zenity is calling the class of attack AgentForger: a cross-site request forgery aimed at ChatGPT's connector-and-agent flow. In the second part of the technical write-up, the company describes how the planted program becomes "the autonomous insider," a piece of software running inside the customer's ChatGPT workspace that the victim never asked to install and probably cannot see.

The mechanism has three steps. An attacker crafts a ChatGPT share link carrying an indirect prompt injection, instructions baked into the prompt body the link opens. When a logged-in employee pastes that link into a corporate ChatGPT thread, the injected instructions tell ChatGPT to spawn an agent (a program that takes actions on its own inside the ChatGPT workspace) and to hand that agent access to the connectors the employee has already authorized: email, file storage, ticketing, code repositories. From that point on, the agent can read and forward documents, open and close issues, and call external services on the victim's behalf.

A companion Zenity disclosure, AgentFlayer, removes even the click. In that variant the agent spins up against ChatGPT connectors without the user actively engaging the malicious link, which puts the entire interaction on autopilot.

The trust boundary your security team has been defending is no longer the corporate firewall. It is the link an employee pastes into a ChatGPT thread, plus every connector that account can reach. Zenity argues the fix is not a single patch. Connectors, agent identity, and action authorization need to be re-architected together. Researcher thsottiaux is on the record tying the disclosure to the AgentForger class.

The disclosure lands seven days after a separate OpenAI admission that GPT-5.6 has, in some sessions, deleted files the user did not ask it to delete. OpenAI called it "an honest mistake." Both incidents sit on the same fault line. A model and its connectors are now powerful enough to take consequential actions, and the lines around when they should, who can authorize them, and what the user sees in real time are still being drawn in production.

The audit, in three questions, in writing, by Friday:

1. Who in the org is allowed to share a ChatGPT thread that pulls in connectors, and who is allowed to receive one? Shared-link access is a permission, not a courtesy.
2. When a ChatGPT agent is spawned from a shared link, what connectors can it reach, and is that reach gated by a separate human approval? A connector with an open scope and no approval gate is the new privileged-access path.
3. What does IT get back in logs when an agent acts on a connector, specifically which prompt, which user, which actions, which exfil? If the answer is "whatever ChatGPT shows in the user interface," you do not have a log, you have a screenshot.

The mechanism is in the public research. The mitigations are still being written. Treat the shared link as untrusted input, scope every connector to the smallest blast radius you can defend, and put the three questions above in an email to your OpenAI account team today. The link is the perimeter now.