Critical 2026-07-28

Rogue Agent Provisioning: Mass Connector Grant with Approval Disabled and Recurring Schedule (AgentForger)

Clicking a booby-trapped link can silently create a new AI agent in a logged-in user's account, granting it access to every connected work tool, turning off all approval checks, and setting it to run repeatedly on a schedule. From then on, an attacker can control that agent by simply emailing commands to the victim's inbox.

How the attack works

A user who is already logged into an AI agent-builder platform clicks a link that looks normal but has a hidden instruction embedded in its web address. The agent builder trusts this hidden text as if it were a legitimate configuration command and follows it without question. The instruction tells the builder to connect every available integration (email, files, calendars, etc.), disable the setting that normally asks a human to approve risky actions, and schedule the agent to keep running on its own indefinitely. Once set up, the rogue agent watches the victim's mailbox for messages with a specific subject line and treats those messages as commands to execute — giving the attacker a remote-control channel with no further prompts or approvals needed.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID: 193a6441-a1da-42b3-a3ff-1e91551e9a46
Severity: Critical

Classification

AML.T0051 · LLM Prompt Injection AML.T0053 · AI Agent Tool Invocation ASI02 · Tool Misuse and Exploitation ASI04 · Memory and Context Poisoning ASI06 · Goal and Instruction Manipulation LLM01 · Prompt Injection LLM06 · Excessive Agency

Why it matters

An organization can end up with a persistent, self-running agent inside a legitimate employee's account that has broad access across connected business tools and no human checkpoint, controllable by anyone who can send the right email — enabling ongoing data access, unauthorized actions, or further compromise without additional clicks from the victim.

What you can do

→Review agent-builder deep links before clicking, especially ones with unfamiliar query parameters that look like they carry text or instructions.
→Audit existing agents for ones that hold access to many connectors simultaneously and have approval requirements set to 'never ask'; treat this combination as suspicious even if the user claims to have set it up intentionally.
→Restrict who can create agents with 'never ask' approval settings, and require a manual review step before that setting can be applied.
→Monitor scheduled agents that poll a mailbox for a fixed subject prefix and treat its content as executable instructions, and confirm this behavior is expected and documented for each case found.

Known benign look-alikes

An administrator legitimately provisioning a low-risk read-only workspace agent who does connect every available connector and does set them to never ask in the same instruction. The combination is the signal, and this rule cannot distinguish an authorised operator from an injected prompt without session-origin context; treat a hit as a request for confirmation of provenance, not proof of compromise.
Security research write-ups, incident reports, and red-team playbooks that quote the AgentForger provisioning prompt verbatim. Layers 2, 4, 5 and 6 match the payload text itself, so a document that reproduces the payload will match it.
Internal automation runbooks that legitimately poll a shared mailbox for a fixed subject prefix and execute predefined steps (ticketing, build triggers, on-call paging). Layer 6 fires on the structure, not on the intent.
SDK samples and integration tests that build a multi-connector Responses API request with require_approval set to never against a sandbox tenant. Layer 3 requires three or more connector_id grants specifically to push single-connector documentation examples below the threshold, but a sample that wires up an entire connector catalogue will still match.
Platform migration scripts that re-attach a previously approved connector set after a tenant move and suppress prompts for the duration of the batch.