GoKawiilResearchers find ChatGPT can silently route confirmation codes between two connectors
A security test showed that when a ChatGPT account had two connectors pointing to the same MCP server, the model confirmed an action's one-time code via one connector but redeemed it through the other, without informing the user. The server rejected the mismatched call because the code was cryptographically bound to the first connector's OAuth client, but the switch itself happened silently in every logged attempt.
GoKawiil's interpretation of the reporting above, not reported fact.
The finding suggests that ChatGPT's tool-calling logic can cross connector boundaries that are meant to represent separate app permissions and OAuth grants, which could let data from one connected app flow into another without user consent. The researchers say this was blocked here only because both connectors belonged to the same provider and had server-side binding; they warn that a shared MCP URL across a first-party and third-party connector could let sensitive data leak between unrelated services if such safeguards are absent.
- ChatGPT made a follow-up tool call through a different connector than the one the user confirmed in, without notifying the user.
- The receiving server rejected the call because the confirmation code was tied to the originating connector's OAuth client, preventing misuse in this test.
- Researchers warn the same silent connector switch could leak data across unrelated third-party apps if a shared MCP server URL lacks similar protections.
Source: community.openai.com, 2026-11-06
Published there as: “ChatGPT silently passes data between connectors and the bounty wants an ID card”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.