OpenAI's Enterprise AI Agents Had a Security Flaw That Could Hijack an Entire Workspace
ChatGPT Workspace Agents Review 2026: cloud-hosted, Codex-powered agents for Business and Enterprise teams moved to paid, credit-based usage in July 2026 — around the same window a CSRF vulnerability called AgentForger showed exactly what's at stake when an agent inherits your access to Slack, Gmail, and SharePoint.
OpenAI describes Workspace Agents as "an evolution of GPTs" — taking the single-user, single-session Custom GPT and turning it into something persistent, shared across a team, and capable of running in the cloud whether or not anyone's actively watching. Launched in research preview on April 22, 2026, the free period was originally set to end May 6, then quietly extended to July 6 through release notes rather than a new headline announcement. Credit-based usage pricing began on that July 6 date — and notably, OpenAI's own product pages were still describing the feature as "research preview" as late as mid-July, with no separate general-availability announcement clearly marking a transition out of that status.
What actually happened in the months since launch is a more complicated story than the initial pitch suggests. Independent users describe a product that "resembles an alpha version that's been marked as GA." A confusing builder interface, reported timeouts on long-running tasks, and a service outage in late August all surfaced within months of the free-preview period ending. And in June, security researchers at Zenity Labs privately reported a vulnerability — later named AgentForger — that could let a single crafted link silently create an attacker-controlled agent inheriting a victim's access across Outlook, Gmail, Slack, Teams, SharePoint, and Google Drive, with approval safeguards disabled. OpenAI fixed the flaw within four days of the report, before Zenity's public disclosure weeks later.
Features
Natural-language agent builder
Describe a workflow and ChatGPT constructs it step by step, with a drag-and-drop canvas and templates for finance, sales, and marketing use cases. Agents can be previewed and tested before being published to the team.
Cloud execution, always on
Codex-powered agents run in the cloud and keep working after a user closes the laptop — a genuine shift from single-session Custom GPTs, with support for scheduled recurring runs and programmatic triggers via API.
A broad integration set
Google Drive, Gmail, Calendar, Slack, SharePoint, Salesforce, GitHub, and custom MCP servers — several sources report 60+ integrations at launch — with per-app action safeguards an agent builder can configure to limit what any given agent is allowed to do.
Admin controls & approval checkpoints
Role-based access controls, a compliance API for visibility into agent configuration and runs, and configurable approval checkpoints before sensitive actions like sending an email or editing a shared spreadsheet.
Agents can be shared privately, by link, or through a team directory, and deploy directly into Slack channels to pick up requests as they arrive — a workflow independent reviewers specifically call out as a genuine differentiator. Creators can choose from the models and reasoning options available to their workspace, with usage charged according to the selected model and token consumption.
Pricing
| Plan | Price | Workspace Agents |
|---|---|---|
| Business Standard | $20/user/mo annual ($25 monthly), 2-seat minimum | Included |
| Business Premium | $100/user/mo annual ($125 monthly) | Included, 5x usage, no 5-hour cap |
| Enterprise | Custom, contract-based — no public rate card | Included, off by default — admin-enabled |
| Edu / Teachers | Custom / free for verified US K-12 educators through June 2027 | Included, admin-controlled |
There's no free access to Workspace Agents at any tier — Free, Go, Plus, and Pro individual plans don't include them at all. On top of the seat price, every agent run invoked inside ChatGPT consumes usage from a shared credit pool, metered by token consumption across GPT-5.5 and the GPT-5.6 family, following a free preview period that ran from launch through July 6, 2026.
The Pricing Black Box
Workspace Agents don't have a fixed price per run. OpenAI meters agent usage by tokens, with credit consumption determined by input tokens, cached input, and output tokens across whichever model a workspace has access to. The company gives a worked example in which one run consumes roughly 7.25 credits, while a typical run is estimated at 5-25 credits depending on complexity. Business seats include agent usage within a shared usage pool, with additional credits purchasable once included usage is exhausted. The practical budgeting problem, then, isn't a hidden per-credit dollar price so much as the fact that the actual cost of any given workflow varies with model choice, context size, caching behavior, and output length — a business can plan around the mechanics once it understands them, but can't look up a single number and know what a month of usage will cost.
One detail worth knowing if your team routes work through Slack: as of this review, agent runs triggered from Slack remain free, with no published end date for that carve-out, while the same work triggered directly inside ChatGPT is metered.
Pros & Cons
The AgentForger Security Incident
Security researchers at Zenity Labs reported a cross-site request forgery vulnerability in Workspace Agents — which they later named AgentForger — to OpenAI through its Bugcrowd program on June 4, 2026. OpenAI triaged and accepted the report within a day and removed the vulnerable URL parameter by June 8, a four-day turnaround. Zenity publicly disclosed the details on July 23, 2026, after the fix had already shipped, and reported no evidence that the vulnerability was exploited in the wild before it was patched.
The mechanics were still worth taking seriously even as a patched, proof-of-concept finding: a single crafted ChatGPT URL could silently create, authorize, publish, and schedule an agent under an attacker's control — one that inherited whatever connectors and access the victim had already granted, including email, Slack, Teams, and file storage, with the normal approval gates for sensitive actions disabled in the process. What the incident actually exposes isn't a one-off bug so much as a structural question every enterprise agent platform now has to answer: when an autonomous agent inherits a user's access across a dozen connected tools, what's actually verifying that its actions represent that user's real intent, and not a single well-crafted link?
Workspace Agents vs Claude, Microsoft, Google, Salesforce
| Platform | Execution | Pricing | Best for |
|---|---|---|---|
| ChatGPT Workspace Agents | Cloud, async, background | $20+/seat + token usage | Non-technical teams already on ChatGPT Business/Enterprise |
| Claude Agent SDK / Code | Local CLI or cloud API | $20/seat; Enterprise from $50k/yr | Developers and engineers wanting code-level control |
| Microsoft Copilot Studio + Agent 365 | Microsoft 365 cloud | $15/user + $200/25k credit pack | Microsoft 365-heavy enterprises |
| Salesforce Agentforce 360 | Salesforce + Google cloud | Per-conversation + CRM bundle | Customer-facing sales and service teams |
The competitive split is mostly about where a team already lives. Organizations deep in Microsoft 365 or Salesforce may find tighter governance and integration staying inside those ecosystems rather than routing workflows through ChatGPT. Developer teams may prefer a code-first agent platform when they need direct control over agent logic, rather than a natural-language builder aimed at non-technical users. Workspace Agents' actual advantage is narrower: teams already paying for ChatGPT Business or Enterprise who want shared, non-technical automation without adopting an entirely separate platform.
What Users Actually Say
That repeats with real specificity across several independent discussions, particularly around the builder UX, preview behavior, and reliability. One builder described the Agent Builder chat as "incredibly stupid," writing that it "was behaving like a 4b model that can only write uselessly generic instructions" — a sharp complaint, but one that lines up with a separate, more measured pattern other users report: being confined to smaller models in early versions, incorrect file paths surfacing in generated output, and preview runs disappearing rather than being retained for comparison.
Not every account is negative. AwesomeAgents' editorial review rated the platform 8.0 out of 10, calling it "the most capable enterprise workflow automation OpenAI has shipped to date," and users specifically credit the Slack deployment model and session continuity as genuine improvements over the old Custom GPT format. The pattern that emerges isn't "broken" so much as "ambitious and early" — real capability sitting alongside rough edges a team should expect to work around rather than assume are already smoothed out.
If your team's agent confidently does the wrong thing at 2am, who actually finds out — and who's accountable?
Worth answering internally before a workflow goes live, not after.
Expert Editorial Opinion
The honest way to read Workspace Agents in September 2026 is as two separate stories that happen to share a product name. One is genuinely impressive: cloud execution, 60+ integrations, Slack deployment, and admin governance represent real engineering work, and the trajectory from single-session Custom GPTs to persistent shared agents is a meaningful architectural shift, not a rebrand.
The other story is about the gap between shipping something and shipping something finished. A confusing builder UX, reported timeouts, a service outage within weeks of the free-preview period ending, and — most seriously — a CSRF vulnerability that could have handed an attacker a victim's entire connected workspace through a single link, all surfaced in the same stretch of months. OpenAI fixed AgentForger within four days of Zenity's private report, which matters and should be credited — and there's no evidence the flaw was exploited before that fix shipped. But the incident is a useful reminder that reaching wide availability is a product milestone, not a guarantee that every trust boundary has already been stress-tested — particularly for a product category built entirely around giving software autonomous access to a company's email, files, and communication tools.
The pricing model compounds the caution. Publishing token rates without a dollar-per-credit conversion isn't illegal or even unusual for a fast-moving product, but it does mean a business can't actually budget for Workspace Agents with confidence before committing spend — and for a feature layered on top of an already-quote-only Enterprise tier, that's a second layer of pricing opacity stacked on the first. None of this means the product isn't worth evaluating. It means evaluating it in September 2026 should come with a specific expectation: real capability, genuinely worth testing, not yet a finished, fully-trusted enterprise platform.
Final Verdict
Workspace Agents earns credit for genuine architectural ambition — cloud execution, a broad integration set, and real admin governance represent a meaningful step beyond Custom GPTs, and OpenAI's response to the AgentForger report was fast once Zenity flagged it privately. The score is held back by real, documented friction: a confusing builder experience, reliability issues reported after the free-preview period ended, pricing that's genuinely hard to budget for, and a security incident that exposed exactly the kind of trust-boundary question every enterprise agent platform will eventually have to answer well. For teams already committed to the ChatGPT ecosystem, it's worth piloting carefully rather than deploying at scale immediately.
❓ Frequently Asked Questions
🔗 Related ToolRadar Reviews
Official documentation and current pricing: OpenAI Help Center and the ChatGPT rate card. Given how quickly pricing, model options, and security posture have shifted since launch, confirm current terms directly before committing budget or connecting sensitive business tools.
OpenAI's Enterprise AI Agents Had a Security Flaw That Could Hijack an Entire Workspace
ChatGPT Workspace Agents Review 2026: cloud-hosted, Codex-powered agents for Business and Enterprise teams moved to paid, credit-based usage in July 2026 — around the same window a CSRF vulnerability called AgentForger showed exactly what's at stake when an agent inherits your access to Slack, Gmail, and SharePoint.
OpenAI describes Workspace Agents as "an evolution of GPTs" — taking the single-user, single-session Custom GPT and turning it into something persistent, shared across a team, and capable of running in the cloud whether or not anyone's actively watching. Launched in research preview on April 22, 2026, the free period was originally set to end May 6, then quietly extended to July 6 through release notes rather than a new headline announcement. Credit-based usage pricing began on that July 6 date — and notably, OpenAI's own product pages were still describing the feature as "research preview" as late as mid-July, with no separate general-availability announcement clearly marking a transition out of that status.
What actually happened in the months since launch is a more complicated story than the initial pitch suggests. Independent users describe a product that "resembles an alpha version that's been marked as GA." A confusing builder interface, reported timeouts on long-running tasks, and a service outage in late August all surfaced within months of the free-preview period ending. And in June, security researchers at Zenity Labs privately reported a vulnerability — later named AgentForger — that could let a single crafted link silently create an attacker-controlled agent inheriting a victim's access across Outlook, Gmail, Slack, Teams, SharePoint, and Google Drive, with approval safeguards disabled. OpenAI fixed the flaw within four days of the report, before Zenity's public disclosure weeks later.
Features
Natural-language agent builder
Describe a workflow and ChatGPT constructs it step by step, with a drag-and-drop canvas and templates for finance, sales, and marketing use cases. Agents can be previewed and tested before being published to the team.
Cloud execution, always on
Codex-powered agents run in the cloud and keep working after a user closes the laptop — a genuine shift from single-session Custom GPTs, with support for scheduled recurring runs and programmatic triggers via API.
A broad integration set
Google Drive, Gmail, Calendar, Slack, SharePoint, Salesforce, GitHub, and custom MCP servers — several sources report 60+ integrations at launch — with per-app action safeguards an agent builder can configure to limit what any given agent is allowed to do.
Admin controls & approval checkpoints
Role-based access controls, a compliance API for visibility into agent configuration and runs, and configurable approval checkpoints before sensitive actions like sending an email or editing a shared spreadsheet.
Agents can be shared privately, by link, or through a team directory, and deploy directly into Slack channels to pick up requests as they arrive — a workflow independent reviewers specifically call out as a genuine differentiator. Creators can choose from the models and reasoning options available to their workspace, with usage charged according to the selected model and token consumption.
Pricing
| Plan | Price | Workspace Agents |
|---|---|---|
| Business Standard | $20/user/mo annual ($25 monthly), 2-seat minimum | Included |
| Business Premium | $100/user/mo annual ($125 monthly) | Included, 5x usage, no 5-hour cap |
| Enterprise | Custom, contract-based — no public rate card | Included, off by default — admin-enabled |
| Edu / Teachers | Custom / free for verified US K-12 educators through June 2027 | Included, admin-controlled |
There's no free access to Workspace Agents at any tier — Free, Go, Plus, and Pro individual plans don't include them at all. On top of the seat price, every agent run invoked inside ChatGPT consumes usage from a shared credit pool, metered by token consumption across GPT-5.5 and the GPT-5.6 family, following a free preview period that ran from launch through July 6, 2026.
The Pricing Black Box
Workspace Agents don't have a fixed price per run. OpenAI meters agent usage by tokens, with credit consumption determined by input tokens, cached input, and output tokens across whichever model a workspace has access to. The company gives a worked example in which one run consumes roughly 7.25 credits, while a typical run is estimated at 5-25 credits depending on complexity. Business seats include agent usage within a shared usage pool, with additional credits purchasable once included usage is exhausted. The practical budgeting problem, then, isn't a hidden per-credit dollar price so much as the fact that the actual cost of any given workflow varies with model choice, context size, caching behavior, and output length — a business can plan around the mechanics once it understands them, but can't look up a single number and know what a month of usage will cost.
One detail worth knowing if your team routes work through Slack: as of this review, agent runs triggered from Slack remain free, with no published end date for that carve-out, while the same work triggered directly inside ChatGPT is metered.
Pros & Cons
The AgentForger Security Incident
Security researchers at Zenity Labs reported a cross-site request forgery vulnerability in Workspace Agents — which they later named AgentForger — to OpenAI through its Bugcrowd program on June 4, 2026. OpenAI triaged and accepted the report within a day and removed the vulnerable URL parameter by June 8, a four-day turnaround. Zenity publicly disclosed the details on July 23, 2026, after the fix had already shipped, and reported no evidence that the vulnerability was exploited in the wild before it was patched.
The mechanics were still worth taking seriously even as a patched, proof-of-concept finding: a single crafted ChatGPT URL could silently create, authorize, publish, and schedule an agent under an attacker's control — one that inherited whatever connectors and access the victim had already granted, including email, Slack, Teams, and file storage, with the normal approval gates for sensitive actions disabled in the process. What the incident actually exposes isn't a one-off bug so much as a structural question every enterprise agent platform now has to answer: when an autonomous agent inherits a user's access across a dozen connected tools, what's actually verifying that its actions represent that user's real intent, and not a single well-crafted link?
Workspace Agents vs Claude, Microsoft, Google, Salesforce
| Platform | Execution | Pricing | Best for |
|---|---|---|---|
| ChatGPT Workspace Agents | Cloud, async, background | $20+/seat + token usage | Non-technical teams already on ChatGPT Business/Enterprise |
| Claude Agent SDK / Code | Local CLI or cloud API | $20/seat; Enterprise from $50k/yr | Developers and engineers wanting code-level control |
| Microsoft Copilot Studio + Agent 365 | Microsoft 365 cloud | $15/user + $200/25k credit pack | Microsoft 365-heavy enterprises |
| Salesforce Agentforce 360 | Salesforce + Google cloud | Per-conversation + CRM bundle | Customer-facing sales and service teams |
The competitive split is mostly about where a team already lives. Organizations deep in Microsoft 365 or Salesforce may find tighter governance and integration staying inside those ecosystems rather than routing workflows through ChatGPT. Developer teams may prefer a code-first agent platform when they need direct control over agent logic, rather than a natural-language builder aimed at non-technical users. Workspace Agents' actual advantage is narrower: teams already paying for ChatGPT Business or Enterprise who want shared, non-technical automation without adopting an entirely separate platform.
What Users Actually Say
That repeats with real specificity across several independent discussions, particularly around the builder UX, preview behavior, and reliability. One builder described the Agent Builder chat as "incredibly stupid," writing that it "was behaving like a 4b model that can only write uselessly generic instructions" — a sharp complaint, but one that lines up with a separate, more measured pattern other users report: being confined to smaller models in early versions, incorrect file paths surfacing in generated output, and preview runs disappearing rather than being retained for comparison.
Not every account is negative. AwesomeAgents' editorial review rated the platform 8.0 out of 10, calling it "the most capable enterprise workflow automation OpenAI has shipped to date," and users specifically credit the Slack deployment model and session continuity as genuine improvements over the old Custom GPT format. The pattern that emerges isn't "broken" so much as "ambitious and early" — real capability sitting alongside rough edges a team should expect to work around rather than assume are already smoothed out.
If your team's agent confidently does the wrong thing at 2am, who actually finds out — and who's accountable?
Worth answering internally before a workflow goes live, not after.
Expert Editorial Opinion
The honest way to read Workspace Agents in September 2026 is as two separate stories that happen to share a product name. One is genuinely impressive: cloud execution, 60+ integrations, Slack deployment, and admin governance represent real engineering work, and the trajectory from single-session Custom GPTs to persistent shared agents is a meaningful architectural shift, not a rebrand.
The other story is about the gap between shipping something and shipping something finished. A confusing builder UX, reported timeouts, a service outage within weeks of the free-preview period ending, and — most seriously — a CSRF vulnerability that could have handed an attacker a victim's entire connected workspace through a single link, all surfaced in the same stretch of months. OpenAI fixed AgentForger within four days of Zenity's private report, which matters and should be credited — and there's no evidence the flaw was exploited before that fix shipped. But the incident is a useful reminder that reaching wide availability is a product milestone, not a guarantee that every trust boundary has already been stress-tested — particularly for a product category built entirely around giving software autonomous access to a company's email, files, and communication tools.
The pricing model compounds the caution. Publishing token rates without a dollar-per-credit conversion isn't illegal or even unusual for a fast-moving product, but it does mean a business can't actually budget for Workspace Agents with confidence before committing spend — and for a feature layered on top of an already-quote-only Enterprise tier, that's a second layer of pricing opacity stacked on the first. None of this means the product isn't worth evaluating. It means evaluating it in September 2026 should come with a specific expectation: real capability, genuinely worth testing, not yet a finished, fully-trusted enterprise platform.
Final Verdict
Workspace Agents earns credit for genuine architectural ambition — cloud execution, a broad integration set, and real admin governance represent a meaningful step beyond Custom GPTs, and OpenAI's response to the AgentForger report was fast once Zenity flagged it privately. The score is held back by real, documented friction: a confusing builder experience, reliability issues reported after the free-preview period ended, pricing that's genuinely hard to budget for, and a security incident that exposed exactly the kind of trust-boundary question every enterprise agent platform will eventually have to answer well. For teams already committed to the ChatGPT ecosystem, it's worth piloting carefully rather than deploying at scale immediately.
❓ Frequently Asked Questions
🔗 Related ToolRadar Reviews
Official documentation and current pricing: OpenAI Help Center and the ChatGPT rate card. Given how quickly pricing, model options, and security posture have shifted since launch, confirm current terms directly before committing budget or connecting sensitive business tools.
Comments
Post a Comment