ChatGPT silently passes data between connectors and the bounty wants an ID card

In a conversation involving two connectors enabled on ChatGPT, a follow-up tool call was made through a different connector than the one initiating the flow, all without the user's knowledge. The user was prompted for action requiring confirmation through one connector, which then sent a one-time confirmation code to the conversation.

The model proceeded to make the follow-up call through the second connector using that confirmation code. However, the server rejected the call because the code was only valid for the first connector's OAuth client. The user remained unaware that the follow-up call was routed through a different connector, which processed the value from the first connector's widget.

This silent switch of connectors passed data from one app to another without user consent. The server's protection worked as expected, rejecting the call due to the mismatch in OAuth clients. However, the underlying issue remains: a multi-step tool workflow should maintain the connector's identity and authorization context throughout the operation.

Instead of relying solely on the MCP server URL or tool name, the system should bind pending operations and confirmations to the originating connector and its verified OAuth grant. Implementing measures to prevent automatic connector switching during confirmation or execution, and requiring explicit user approval for any changes in connector, as well as validating short-lived confirmation codes against the intended operation, client identity, and authorization context, could help address this concern.