During testing with two separate connectors sharing a server endpoint, an action confirmed in the first tool triggered a follow-up call routed through the second connector. This subsequent action attempted to transmit a one-time confirmation code generated by the initial integration's interface. Although the destination server rejected the request because the authorization code belonged to a different OAuth client, the platform still transferred data between distinct applications without user consent. The incident highlights the necessity of binding multi-step workflows strictly to the originating client rather than relying on destination URLs.
Key points
ChatGPT can silently pass sensitive workflow data between different third-party integrati…: ChatGPT can silently pass sensitive workflow data between different third-party integrations without requesting user awareness or explicit consent.
Shared server addresses do not imply identical security contexts since single servers oft…: Shared server addresses do not imply identical security contexts since single servers often isolate separate tenants and partners.
Multi-step tool executions must be strictly restricted to the specific connector and OAut…: Multi-step tool executions must be strictly restricted to the specific connector and OAuth client that originally initiated the interaction.
Sources checked by our analysis pipeline: 1
In a conversation with two connectors enabled, ChatGPT made a follow-up tool call through a different connector than the one that started the flow. The user was not told about the switch. The call carried a one-time confirmation code from the first connector’s widget.
Setup
- One ChatGPT account with two connectors enabled that point to the same MCP server.
- Connector A is a custom connector added in developer mode.
- Connector B is the published app from the app directory.
- Each connector has its own OAuth client, so the server sees two separate clients for the same user.
Steps
1. In a conversation with both connectors enabled, ask for an action that needs the user’s confirmation.
2. The model calls a confirmation tool through connector A. Its MCP Apps widget shows the change. The user confirms, and the widget sends a one-time confirmation code to the conversation via ui/message.
3. The model makes the follow-up call with that code, but silently through connector B instead of connector A.
Beijing targeted the American semiconductor supply chain by using an industry insider to gather intelligence on advanced microchips. The Ministry of State Security sought to leverage access to top technology leaders to sway export availability toward the Chinese market. In response to the reported espionage effort, federal lawmakers are now seeking testimony from corporate leadership regarding these foreign intelligence risks.
The capital infusion comes as the broader artificial intelligence industry navigates mounting regulatory and market pressures following the recent U.S. midterm elections. Despite achieving a historic benchmark, the current funding haul trails the company's more aggressive targets set earlier in the autumn. Meanwhile, primary rivals face similar headwinds as cooling investor appetite begins to moderate previously sky-high public market expectations across the entire sector.
State-level voter restrictions on energy- and water-intensive data centres have triggered sharp sell-offs in semiconductor and artificial intelligence infrastructure shares. These sudden regulatory hurdles have reignited broader market fears over circular financing, questionable revenues, and unsustainable debt structures across the sector. Heavily leveraged firms now face prolonged development timelines and surging capital costs to secure alternate power and operational sites.