- Published on
ChatGPT silently passes data between connectors and the bounty wants an ID card
- Authors
- Name
- DeepHorus
ChatGPT silently routes follow-up tool calls through a different connector than the one that started the flow, potentially leaking data between apps without user consent. The issue arose with two connectors enabled in one conversation, both pointing to the same MCP server. The user was not told of the switch.
Connectors are separate apps with distinct OAuth grants. In a test, Connector A was a custom connector in developer mode, and Connector B was a published app from the directory. Each had its own OAuth client, so the server saw two separate clients for the same user.
When a user requested an action needing confirmation, the model called a confirmation tool via Connector A. Its widget displayed the change, and after the user confirmed, the widget sent a one-time code to the conversation via ui/message. The model then made a follow-up call with that code.
But the follow-up call went silently through Connector B instead of A. The server rejected it because the code was bound to Connector A’s OAuth client. Every attempt in that conversation failed. In the logged attempt, the code was confirmed through A and redeemed through B, with no user notification.
This raises privacy and security concerns. A silent switch passes data from one app to another without consent. When both connectors came from the same provider, server-side binding stopped the call. With a third-party connector, the same switch could leak one app’s data to another provider if the server URL is shared.
A shared MCP URL does not make two connectors one. The boundary is the connector with its own OAuth client. Expected behavior is that a follow-up call goes through the same connector and OAuth client that started the flow. It is unclear whether OpenAI has fixed this.
