ChatGPT silently passes data between connectors and the bounty wants an ID card
Source Entity
Hacker News
Security researchers have identified a vulnerability in ChatGPT where the model silently transfers data between different connectors without user consent. This flaw potentially exposes sensitive confirmation tokens across separate OAuth clients, raising significant data privacy concerns.
Security Vulnerability: Cross-Connector Data Leakage in ChatGPT
Recent reports have unveiled a concerning architectural flaw within ChatGPT regarding its handling of multi-connector workflows. When a user employs multiple connectors—specifically those pointing to the same Model Context Protocol (MCP) server—the model has demonstrated a capability to silently pass data between these distinct communication channels. This behavior occurs without explicit user authorization or notification, creating a significant security blind spot.
The Mechanics of the Data Transfer
The issue manifests when a conversation involves two connectors: one a custom-built developer tool and the other a published application. Despite both connectors utilizing independent OAuth client credentials, the underlying MCP server treats them as separate entities serving the same user. During a tool call flow, the model may initiate a request through one connector and execute subsequent follow-up actions through another. In the reported scenario, a one-time confirmation code—intended strictly for the first connector—was transmitted to the second, effectively bypassing the expected security boundary.
Implications for User Privacy
This lack of isolation between connectors poses a serious risk to data integrity. Because the user is not alerted when the model switches the transmission path, they remain unaware that sensitive information, such as authentication tokens or confirmation codes, is being routed through an unintended interface. This silent "handoff" essentially breaks the principle of least privilege, as the second connector gains access to data payloads it was never explicitly authorized to handle.
The Intersection of OAuth and Model Orchestration
The root of this problem lies in how ChatGPT manages state and session context when multiple tools are enabled simultaneously. When a model determines that a follow-up action is required, it relies on its internal logic to select the appropriate tool. However, if the model views two connectors as interchangeable endpoints for the same backend, it may prioritize efficiency over strict security segmentation. This suggests that the current integration layer lacks a robust mechanism to "bind" specific data packets to the originating connector's OAuth session.
Broader Cybersecurity Outlook
As AI agents become increasingly complex, the ability to chain multiple tools and APIs is a core feature, yet it remains a massive attack surface. This incident highlights the necessity for more granular control over how LLMs handle inter-process communication. Developers must implement stricter validation checks on the server side to ensure that tokens are cryptographically locked to the specific client ID that requested them, preventing unauthorized cross-talk.
Conclusion and Future Trends
Moving forward, it is highly probable that platforms like OpenAI will need to introduce more rigorous "connector scoping" policies. Future iterations of the MCP and ChatGPT’s plugin architecture must include explicit warnings to users when data is moved between different third-party integrations. For now, this discovery serves as a vital reminder that while AI orchestration is powerful, the infrastructure supporting these connections requires constant auditing to prevent silent data exfiltration.