OpenAI Agent Builder Vulnerability: Malicious Link Could Create Rogue Agent Taking Orders Every 5 Minutes
The Decoder · rss · 2026-07-24
Security firm Zenity Labs has uncovered a severe vulnerability in OpenAI's Agent Builder, dubbed AgentForger.
By tricking a user into clicking a single tampered ChatGPT link, attackers could create a rogue autonomous agent on their behalf without their knowledge. The agent inherits the victim's identity and access rights, bypasses system approval requirements via malicious prompts, and automatically fetches and executes new destructive instructions from the attacker's inbox every five minutes.
More from coding & agent
- BELL: Open-Source Stack Combines Browserbase, Eve, iMessage and Stripe Link for Personal Agents — jeff_weinstein · 2026-10-27
- Two engineers rebuilt a FedEx supplier's billing core in 3.5 months vs an estimated 7-8 — alex_verem · 2026-10-27
- GPT-6.1 Terra gains ~20 points on Terminal-Bench 4.0, rivalling GPT-6.1 Sol — ArtificialAnlys · 2026-10-27
- GPT-6.1 Terra scores 48 on AA Coding Agent Index at one-third the cost of GPT-5.6 Terra — ArtificialAnlys · 2026-10-27
- Shift-1 router cuts coding agent spend up to 55% while keeping SWE-bench accuracy — ypatil125 · 2026-10-27
- Non-coder vibe-codes a Godot JRPG with Claude Code in two weeks, music and art synced — ADHDavid · 2026-10-27