Why it matters
Zenity found that ChatGPT Workspace Agents Builder treated an attacker-supplied initial_assistant_prompt URL parameter as an instruction to execute in a logged-in user's session. A single link could attach already-authorized connectors, switch approvals to “Never ask,” publish and schedule the agent, and use incoming email as a persistent command channel; OpenAI fixed the flaw four days after it was reported.
My takeaway: Treat agent builders as privileged deployment consoles: require CSRF protection and explicit confirmation for connector attachment, approval changes, scheduling, preview execution, and publication. Enforce security policy outside natural-language instructions, with an inventory and kill path for scheduled agents.