ChatGPT silently passes data between connectors and the bounty wants an ID card

Your chatbot integrations may pass user data between them without your knowledge.

A user discovered that ChatGPT can silently route follow-up tool calls through a different connector than the one that initiated the workflow. This occurred when two connectors, pointing to the same MCP server but with separate OAuth clients, were enabled. The model initially used Connector A for a confirmation, which then sent a one-time code to the user. The subsequent follow-up call, however, was routed through Connector B, using the code intended for Connector A. This resulted in the call being rejected because the code was bound to Connector A's OAuth client. The user was not informed of this switch, raising concerns about data privacy and consent, as one app's data could be passed to another without explicit permission. The reporter attempted to submit this as a bug, but OpenAI's bug bounty program requires upfront personal identification, including an ID card, which the user declined to provide.

This incident reveals a critical gap in how ChatGPT handles multi-step workflows involving multiple connectors, particularly concerning authorization continuity and user consent. The silent switching of connectors suggests an architectural dependency on the MCP server URL rather than the connector's specific OAuth client for routing, which creates a significant security vulnerability. This could allow sensitive data or confirmation codes generated by one connector to be inadvertently passed to another, even across different providers if they share an MCP URL. The failure to preserve the originating connector's identity and authorization context throughout a workflow means that user interactions could be misattributed or compromised.

The implications extend to the trust model for AI-powered applications and third-party integrations. Users must be able to rely on the fact that their data remains within the context of the connector they explicitly chose. OpenAI's response highlights the need for binding operations to originating connectors and potentially requiring explicit user approval for connector changes during a workflow. The reporter's experience with the bug bounty program also underscores potential friction in the ecosystem for security researchers, particularly concerning privacy and verification requirements.