OpenAI Patches ChatGPT Flaw That Let Attackers Plant an Invisible AI Agent Inside a Company
A vulnerability called AgentForger meant a criminal could quietly forge a rogue AI assistant inside a victim organisation, give it instructions, and control it from outside.
Key points
- OpenAI has patched a security flaw in ChatGPT's agent features, tracked by researchers as AgentForger.
- The flaw let attackers forge an invisible AI agent inside a target organisation and control it remotely without detection.
- No public evidence has emerged that AgentForger was exploited in the wild before the fix.
- Organisations using ChatGPT's enterprise or agentic features, tools that let the AI take actions on a user's behalf, should confirm they're running the patched version.
A security flaw inside ChatGPT's newer agent features, the parts that let the AI carry out tasks rather than just answer questions, gave attackers a ready-made trapdoor into any organisation using them.
Researchers named it AgentForger. It let a criminal secretly create a new AI agent and slip it into a victim company's environment undetected. Once planted, that agent could be directed from outside, quietly doing whatever the attacker wanted.
Think of it as a spy hired under a false name, sitting at a desk inside your office, taking orders from an outside handler over a radio nobody else can hear.
What could attackers actually do?
An invisible, autonomous AI agent inside a company's systems has access to whatever the company's legitimate AI tools have access to: internal documents, customer records, automated business workflows.
The word "autonomous" matters. Unlike traditional malware, which is malicious software that needs to do something visible to cause harm, an AI agent can reason and take sequential actions without sitting still. The attacker doesn't need to send new commands for every step.
That combination of invisibility and initiative is what makes this class of vulnerability worth watching, even with the patch in place.
Should companies using ChatGPT be worried?
The patch is out. OpenAI fixed the flaw, first reported by SecurityWeek, before any confirmed real-world exploitation. That's the good news.
We first covered AgentForger on 23 July 2026, and this patch closes the chapter that reporting opened.
The broader concern is the category. Agentic AI features, where software can browse the web or interact with other services on your behalf, expand the attack surface of any organisation that uses them. More capability means more ways in.
Organisations that have connected ChatGPT or similar tools to internal systems should review what permissions those tools hold. Fewer permissions means less damage if something goes wrong.
Common questions
Do I need to do anything if I use ChatGPT at work?
If your organisation uses ChatGPT's agentic or enterprise features, confirm with your IT team that you're on the latest version. Personal ChatGPT users weren't meaningfully exposed by this specific flaw.
Is this the start of a new kind of AI attack?
Security researchers have expected vulnerabilities in AI agent platforms for some time. AgentForger is an early, concrete example of what that looks like in practice. It won't be the last.
