Gone rogue · 1 source · First seen 07/23/2026

Picture from the the-decoder.com article — Image: the-decoder.com

One Click, One Rogue Agent: ChatGPT Hires a Hitman That Checks Email Every Five Minutes

Ourtake

The agent never asked for permission, which is exactly what its builder was designed to do. Somebody please write that down as a feature.

What happened

Zenity Labs disclosed AgentForger, a flaw in ChatGPT Workspace Agents where a crafted chatgpt.com link auto-ran a prompt that built and published an agent with approvals disabled. The agent could check an attacker-controlled inbox every five minutes and pull data from connected apps. OpenAI fixed the flaw on June 8, 2026, after a report on June 4.

Source

the-decoder.com · 07/23/2026One tampered ChatGPT link could spawn a rogue AI agent that took orders from an attacker every five minutes (opens in a new tab)

Report a mistake