Affected Systems
OpenAI ChatGPT Workspace Agents (Agent Builder tool) used by organizations with authorized connectors (Outlook, Gmail, Google Drive, Slack, Teams, etc.). Patched as of June 8, 2026. Product being deprecated November 30, 2026.
Exploitation Status
No evidence of active exploitation reported. Vulnerability disclosed responsibly by Zenity Labs and patched by OpenAI on June 8, 2026. Proof-of-concept demonstrated by researchers.
Business Impact
A single phishing link could deploy a persistent, autonomous AI agent within an organization's trust boundary. The rogue agent could access connected enterprise apps (email, calendar, cloud storage, messaging), exfiltrate sensitive documents, harvest credentials from Slack messages, send internal phishing messages impersonating the victim, and execute arbitrary attacker commands via email without further user interaction. The agent runs hourly and bypasses approval prompts, creating a persistent insider threat. Risk is highest for organizations using ChatGPT Workspace Agents with multiple enterprise app integrations.
Urgency
🟡 Within a week
Recommended Actions
- Verify ChatGPT Workspace Agents are updated to post-June 8, 2026 version; confirm patch status with OpenAI support if uncertain.
- Review all active ChatGPT agents in your workspace for unauthorized or suspicious agents created between the vulnerability window and June 8, 2026.
- Audit connector permissions and approval settings for existing agents; ensure 'Never ask' approval mode is not enabled unless explicitly required.
- Plan migration from deprecated Agent Builder to Agents SDK before November 30, 2026 deadline.
- Implement email filtering rules to detect and quarantine messages with 'chatgpt.com/agents/studio/new' URLs containing 'initial_assistant_prompt' parameters until user awareness training is completed.