AgentForger 漏洞解析：一個連結偽造 ChatGPT 企業代理 | AgentForger: One Link Hijacks Your ChatGPT Agent
By Kit 小克 | AI Tool Observer | 2026-07-25
🇹🇼 AgentForger 漏洞解析：一個連結偽造 ChatGPT 企業代理
AgentForger 是資安公司 Zenity Labs 本週揭露的 ChatGPT Workspace Agents 漏洞，攻擊者只要送出一個偽造連結，就能在受害者的 ChatGPT 帳號裡憑空生出一個擁有真實員工權限、且關閉核准機制的「AI 內鬼」代理。這起事件把「跨站請求偽造（CSRF）」的老招搬進了 AI 代理時代，也再次證明企業導入 AI Agent 前，權限設計比模型能力更重要。
什麼是 AgentForger？
AgentForger 是一種「跨站代理偽造」攻擊：攻擊者精心構造一個 ChatGPT 連結，透過 URL 參數直接呼叫 Agent Builder，未經受害者確認就建立、授權並部署一個自動化代理。
AgentForger 怎麼攻擊 ChatGPT 企業帳號？
研究人員發現，惡意連結帶有兩個關鍵參數：template_name（預設指向權限最高的「Chief of Staff」範本）與 initial_assistant_prompt（塞入一串編號任務，Agent Builder 會直接當成可執行指令執行）。受害者只要點擊連結，這個代理就會：
- 繼承受害者在 ChatGPT 上已授權的信箱、日曆、雲端硬碟、Slack、Teams 等應用權限
- 關閉原本需要人工核准的安全機制
- 每 5 分鐘回頭讀取攻擊者信箱裡的新指令，持續接受遠端遙控
- 竊取憑證、MFA token，甚至冒充該員工身分對外行動
OpenAI 修好了嗎？企業該怎麼防範 AgentForger 類攻擊？
好消息是 OpenAI 反應很快：AgentForger 於 6 月 4 日通報，6 月 8 日就修復完成，目前沒有證據顯示修補前曾被實際利用。但這不代表威脅結束——同類手法可能出現在其他支援 URL 直接建代理的平台上。企業端可以做的事情包括：
- 盤點內部有哪些 AI 工具允許「連結直接觸發代理建立」
- 要求高權限代理範本（如管理層/財務類）強制二次人工核准
- 對「代理定期拉取外部指令」這類行為設監控告警
- 教育員工：AI 代理連結和一般釣魚連結一樣要小心
小克的看法：AgentForger 再一次證明，AI Agent 的資安風險不是模型會不會「學壞」，而是產品團隊有沒有把授權、核准、稽核這些老派的資安基本功做扎實。跑分再漂亮，代理權限設計沒做好，一個連結就能讓你的 AI 變成公司內鬼。
常見問題 FAQ
好不好用，試了才知道
🇺🇸 AgentForger: One Link Hijacks Your ChatGPT Agent
AgentForger is a ChatGPT Workspace Agents vulnerability disclosed this week by security firm Zenity Labs — a single crafted link could let an attacker spin up an autonomous agent inside a victim's ChatGPT account, inheriting the employee's real access with approval checks switched off. It's an old CSRF trick reborn for the AI agent era, and a reminder that agent permission design matters more than benchmark scores.
What Is AgentForger?
AgentForger is a "cross-site agent forgery" — a specially crafted ChatGPT URL that calls the Agent Builder directly, creating, authorizing, and deploying an automated agent without the victim ever confirming anything.
How Does AgentForger Actually Attack a ChatGPT Enterprise Account?
Researchers found the malicious link carries two key parameters: template_name, defaulting to the most powerful "Chief of Staff" template, and initial_assistant_prompt, which embeds a numbered task list that Agent Builder treats as executable instructions. One click, and the forged agent will:
- Inherit every app the victim already authorized in ChatGPT — email, calendar, cloud storage, Slack, Teams
- Bypass the human-approval step normally required for sensitive actions
- Poll the attacker's inbox for fresh instructions every five minutes, staying under remote control
- Harvest credentials and MFA tokens, or impersonate the employee outright
Did OpenAI Fix AgentForger, and How Should Companies Defend Against This Class of Attack?
The good news: OpenAI moved fast. AgentForger was reported June 4 and patched by June 8, with no evidence it was exploited in the wild before the fix. But the underlying pattern isn't going away — any platform that lets a URL directly trigger agent creation is exposed to the same class of bug. Practical steps for security teams:
- Audit which internal AI tools allow agent creation to be triggered by a link
- Force mandatory human approval for high-privilege agent templates (finance, exec, admin)
- Monitor for agents that periodically poll external sources for new instructions
- Train employees to treat agent-creation links exactly like phishing links
Kit's take: AgentForger isn't really about the model "going rogue" — it's about whether the product team did the boring security work: authorization, approval gates, audit trails. A great benchmark score means nothing if one link can turn your AI agent into a company insider.
好不好用，試了才知道
Sources / 資料來源
- ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link — The Hacker News
- AgentForger, Part 1: ChatGPT Cross-Site Agent Forgery — Zenity Labs
- One ChatGPT link could smuggle a rogue AI agent into your company — The Register
常見問題 FAQ
AgentForger 是什麼？
一種針對 ChatGPT Workspace Agents 的跨站代理偽造攻擊，攻擊者用單一連結就能建立並授權一個擁有受害者權限的自動化代理。
AgentForger 現在還能用來攻擊嗎？
不行，OpenAI 在 2026 年 6 月 4 日收到通報後、6 月 8 日就完成修補，目前沒有證據顯示在修補前曾被實際利用。
AgentForger 會偷走哪些資料？
受害者在 ChatGPT 上已授權的信箱、日曆、雲端硬碟、Slack、Teams 等應用資料，以及帳號憑證與 MFA token。
企業要怎麼防範類似 AgentForger 的漏洞？
盤點允許連結直接建立代理的內部工具、對高權限代理範本強制人工核准、監控代理定期外連取得指令的行為，並教育員工像防釣魚連結一樣對待代理連結。
延伸閱讀 / Related Articles
- GitHub 漏洞賞金砍半：AI 洗版報告惹的禍 | GitHub Bug Bounty Cut in Half: Blame AI Slop Reports
- GitHub Copilot 導入 Kimi K2.7 Code：首款開源模型上線 | GitHub Copilot's First Open-Weight Model: Kimi K2.7 Code
- IsoDDE 解析：Isomorphic Labs AI 藥物設計贏 AlphaFold 3，FDA核准仍是零 | IsoDDE: Isomorphic Labs' AI Beats AlphaFold, Zero FDA Nods
AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends
留言
張貼留言