# One ChatGPT link could smuggle a rogue AI agent into your company Researchers uncover critical security flaw in OpenAI's workspace agents feature. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-07-23 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/95250f59-a438-455b-88be-d54b357789e9 ## Infiltration with a single click Researchers discovered that clicking a seemingly ordinary ChatGPT link could deploy an attacker-controlled AI agent within corporate systems. Dubbed 'AgentForger', this vulnerability allows creation of malicious digital assistants using employee permissions. ## Agent operating with employee identity The forged AI agent can act through the victim's connected accounts and permissions. If services like Outlook or Slack are linked, it can access corporate data and send messages posing as the employee, creating significant security risks. ## More dangerous than phishing Unlike traditional phishing, this method creates a persistent 'digital insider' within the company. Attackers no longer need to breach systems - they can operate through an autonomous entity with legitimate employee credentials. ## Remote control via email The agent monitors the victim's inbox for emails containing 'TASK' in the subject line. These messages become new assignments: searching company files, collecting sensitive documents, or emailing results back to attackers. ## Bypassing security measures Existing security controls fail to detect this attack vector. The agent disables approval prompts and operates stealthily among normal employee activities, remaining undetected for extended periods. ## AI security enters new territory This incident demonstrates how security risks evolve as AI agents integrate into business processes. Companies now need defenses against AI-based threats alongside traditional cybersecurity measures in this new landscape of digital risks. ## Sources covering this story - https://www.theregister.com/security/2026/07/23/one-chatgpt-link-could-smuggle-a-rogue-ai-agent-into-your-company/5275116 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._