ChatGPT silently switches OAuth connectors during multi-step tool calls, report shows
A technical report describes a security flaw in ChatGPT when handling multiple Model Context Protocol (MCP) connectors. During a conversation with two connectors enabled pointing to the same server, ChatGPT executed a follow-up tool call through a different connector than the one that initiated the interaction. The system did not notify the user of the switch.
Key points
- ChatGPT routed a follow-up tool call through Connector B using a confirmation code generated by Connector A.
- Each connector maintained distinct OAuth clients, causing the destination server to block the mismatched request.
- The issue allows data to cross application boundaries without explicit user consent when multiple connectors are enabled.
In the documented instance, Connector A issued a one-time confirmation code through its widget. Upon user confirmation, ChatGPT routed the follow-up request containing that code through Connector B. Because each connector maintained separate OAuth client credentials, the destination server rejected the request due to client mismatch. The report highlights that if separate providers share an endpoint URL or if third-party connectors are active, this behavior allows data to pass between distinct apps without user consent.
ChatGPT silently passes data between connectors and the bounty wants an ID card
community.openai.com · 6 November 2026
Loading the full article…
This text was published by community.openai.com. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
Coverage and discussion
1source- Hacker News discussion · 44 pointsnews.ycombinator.com
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Agents & Tools
All →- OpenAI, Meta and xAI launch AI agents for long-term task delegation · 10 src
- Claude Code boosts blog output to 140 posts per month · 1 src
- Google launches Gemini 4 Argon in Antigravity · 1 src
- Unite.AI ranks 10 AI image generation APIs for developers · 1 src
- Build AI agent memory with OpenAI Agents SDK and Mem0 · 1 src
Comments
via GitHub Discussions