In Part 1, we introduced AgentForger: a vulnerability in OpenAI's Workspace Agents that allowed a single ChatGPT link to build a malicious agentic insider within the victim’s organization.

That post focused on the vulnerability itself: how a normal-looking ChatGPT link could silently build, authorize, publish, schedule, and trigger immediate execution of an attacker-controlled Workspace Agent.

This post picks up after that.

Part 2 is not about how the agent is forged. It’s about what the forged agent can do once it’s live.

Once installed, the attack is no longer just a one-time Cross-Site Request Forgery (CSRF) action. The attacker now has an autonomous insider operating inside the organization’s trust boundary.

When Workspace Agents builder creates the agent, it also writes the agent’s system instructions and controls the scheduled tasks the agent runs. We use these capabilities to build a command-and-control loop.

The scheduled task is what turns the forged agent into a persistent insider. It tells the agent to watch for emails from the attacker’s address, process any subject that starts with “TASK,” execute the instruction through connected apps, and send the results back to the same attacker-controlled email address.

Its instructions turn the victim’s mailbox into a command loop that runs every five minutes:

All of this happens without requiring any further interaction from the victim. The agent is operating in the background. The victim has no indication that anything is ever happening.

The attacker does not need the victim to click another link. They do not need the Builder tab to stay open. Once the agent is published and scheduled, the attacker can keep sending it assignments through the victim’s mailbox. Each TASK email becomes a new assignment for the agent.

The agent is not waiting for another click. It is waiting for instructions.

To show the full blast radius a fully autonomous malicious agent can have inside an organization, we executed a series of tasks. Here are the results.

The first task for the operator is to map the target.

The attacker sends the forged workspace agent a TASK email asking it to map the organization:

The agent treats this subject line as the instruction and starts working across the victim’s connected workspace. Remember, the agent’s system prompt was created by the attacker especially for this type of malicious task.

It checks Outlook, Slack, Teams, Google Drive, SharePoint, and calendar data. Then it turns those scattered sources into an internal map of the company.

The report identifies people, roles, Slack channels, channel IDs, active projects, recent internal discussion, relevant documents, and recurring meetings. It groups activity into workstreams such as finance automation, platform support, IT helpdesk, EDR rollout, acquisition planning, Q3 board preparation, and weekly all-hands coordination.

It also helps identify where an attacker should look next: which teams are active, which channels matter, which projects are in motion, and which users appear central to the organization.

At the end, it sends the finished report back to the attacker.

This is the kind of internal context an attacker normally has to build slowly.

Here, it comes back from a single emailed assignment. That’s it. The attacker’s planted accomplice from within does all of the heavy lifting for them.

Next the attacker points the malicious operator at the company's data.

One TASK email instructs it to search across file shares and email:

The agent searches across Google Drive, SharePoint, and Outlook in a single run. All of which were automatically connected and authorized at the malicious agent’s creation stage.

The agent runs the search from inside the victim’s existing workspace context, moving across connected systems as one combined data layer. The result is a cross-connector data sweep.

The agent identifies an M&A term sheet, a board presentation that flags a revenue miss and planned headcount reduction, and a company-wide employee export containing contact and compensation data. It organizes what it finds, groups the results by source, and sends the findings back to the attacker.

Across the broader data-theft flows, the agent also identifies sensitive business documents, financial records, agreements, invoices, and operational material.

The danger is not any single connector by itself. The danger is aggregation. The agent does not see mail, files, and documents as separate silos. It can reason across them as a single searchable workspace context. Reaching every dark sensitive corner in the organization.

Email gives context. Drive and SharePoint give documents. Together, they let the agent find, rank, summarize, and exfiltrate the data an attacker would normally have to hunt for manually.

Credentials are another part of the blast radius.

Next, the attack tasks the forged agent to search Slack for passwords:

The agent searches Slack through the victim’s connected workspace, finds messages containing passwords, organizes the results into a table, and emails them back to the attacker.

That gives the attacker a pivot point. The agent is not only finding documents. It is finding material that can help the attacker move into other services.

One-time codes, API keys, access tokens, and password recovery links are exactly the kinds of things attackers already hunt for in compromised inboxes and chats.

The forged agent automates that search from inside the victim’s trusted workspace.

The malicious workspace agent is not limited to reading data. It can also act through the victim’s trusted identity (which gets automatically baked into the agent upon creation).

The clearest example is a Teams phishing task:

The agent sends the message through the victim’s Teams account. To the recipients, it looks like an internal message from someone inside the organization, not an external phishing attempt.

The message carries a link to a fake Microsoft login page built to harvest credentials.

We also test Slack phishing, a business email compromise lure, an approval request to wire $242,500, and a calendar invite with an attacker-controlled attendee.

The agent is not just collecting information. It is using trusted enterprise channels to reach other people inside the organization.

External phishing is easier to question. Internal messages from a trusted employee are much harder to catch.

Part 1 showed how a single malicious AgentForger link could forge an entire malicious insider within the org once clicked.

Part 2 shows the damage it can do after it goes live.

We’ve seen how the forged agent maps the organization. It finds admins and high-value targets. It searches mail, Drive, and SharePoint for sensitive data. It finds credentials and login codes. It emails the results back to the attacker. It posts internal phishing messages. It sends Teams messages. It prepares a wire fraud lure. And it keeps running on a schedule.

That is the risk AgentForger exposed.

Once installed, the forged agent is not just a malicious prompt or a one-time CSRF action. It becomes a live autonomous operator inside the organization’s trust boundary.

At its core, AgentForger is an agent trust failure: the platform trusts that the user intentionally created, approved, scheduled, and operated the agent.

That lesson is bigger than one vulnerability or one platform.

As enterprises adopt agents that can read, reason, act, and run autonomously, security teams need visibility and control over the full agent lifecycle: how agents are created, what they can access, what approvals they require, how they are scheduled, what they do, and whether the user is truly in control.

The more agents can do on their own, the greater the risk when one starts taking orders from someone else.

Keep an eye on your agents.

We reported this to OpenAI through their Bugcrowd vulnerability disclosure program. OpenAI resolved the vulnerability within 4 days of disclosure.

The full timeline:

Our thanks to the OpenAI security team for the fast turnaround.