{"slug": "chatgpt-silently-passes-data-between-connectors-and-the-bounty-wants-an-id-card", "title": "ChatGPT silently passes data between connectors and the bounty wants an ID card", "summary": "ChatGPT silently routed a follow-up tool call through a second connector instead of the one that initiated the flow, carrying a one-time confirmation code produced in the first connector's MCP Apps widget, according to a logged test report. In the documented setup, a custom developer-mode connector and a published app-directory connector pointed at the same MCP server but held separate OAuth clients; the server rejected the call because the code was bound to the first connector's OAuth client, and every attempt in that conversation failed. The report warns that with a third-party connector enabled in the same conversation, the same silent switch could pass one app's data to another provider when the server URL is shared, and argues tool calls should be matched to a connector by OAuth client rather than MCP server URL.", "body_md": "In a conversation with two connectors enabled, ChatGPT made a follow-up tool call through a different connector than the one that started the flow. The user was not told about the switch. The call carried a one-time confirmation code from the first connector’s widget.\n\n**Setup**\n\n- One ChatGPT account with two connectors enabled that point to the same MCP server.\n\n- Connector A is a custom connector added in developer mode.\n\n- Connector B is the published app from the app directory.\n\n- Each connector has its own OAuth client, so the server sees two separate clients for the same user.\n\n**Steps**\n\n1. In a conversation with both connectors enabled, ask for an action that needs the user’s confirmation.\n\n2. The model calls a confirmation tool through connector A. Its MCP Apps widget shows the change. The user confirms, and the widget sends a one-time confirmation code to the conversation via ui/message.\n\n3. The model makes the follow-up call with that code, but silently through connector B instead of connector A.\n\n**Result**\n\nThe server rejects the call, because the code is bound to connector A’s OAuth client. Every attempt in that conversation failed. In the attempt we logged in detail, the code was confirmed through connector A and redeemed through connector B. Nothing told the user that the follow-up call went to another connector.\n\nWhy this is a problem?\n\nThe user starts the flow with connector A and confirms in connector A’s widget. The follow-up call then goes to connector B without the user knowing, and it carries a value produced in connector A’s widget. Connectors are separate apps with separate OAuth grants, so this silent switch passes data from one app to another without the user’s consent.\n\nHere both connectors came from the same provider, so our server-side binding stopped the call. With a third-party connector enabled in the same conversation, we expect the same silent switch to pass one app’s data to another provider if the server URL is shared.\n\nA shared MCP URL is not enough to treat two connectors as one. Behind the same URL, a server can act for different parties depending on the OAuth client, for example separate tenants, partners or environments. The boundary is the connector with its own OAuth client, not the URL.\n\n**Expected behavior**\n\nTool calls are matched to a connector by its OAuth client, not by the MCP server URL. A follow-up call goes through the same connector and OAuth client that started the flow.", "url": "https://wpnews.pro/news/chatgpt-silently-passes-data-between-connectors-and-the-bounty-wants-an-id-card", "canonical_source": "https://community.openai.com/t/security-follow-up-tool-call-silently-routed-to-a-different-connector/1413053", "published_at": "2026-11-06 22:50:43+00:00", "updated_at": "2026-11-06 23:19:36.302428+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-safety", "ai-products"], "entities": ["ChatGPT", "OpenAI", "MCP", "MCP Apps"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/chatgpt-silently-passes-data-between-connectors-and-the-bounty-wants-an-id-card", "markdown": "https://wpnews.pro/news/chatgpt-silently-passes-data-between-connectors-and-the-bounty-wants-an-id-card.md", "text": "https://wpnews.pro/news/chatgpt-silently-passes-data-between-connectors-and-the-bounty-wants-an-id-card.txt", "jsonld": "https://wpnews.pro/news/chatgpt-silently-passes-data-between-connectors-and-the-bounty-wants-an-id-card.jsonld"}}