Security: Follow-up tool call silently routed to a different connector

Why it matters

The article documents a flaw in how ChatGPT handles connectors during a conversation. A user had two connectors enabled, both pointing to the same MCP server but each with its own OAuth client: a custom developer-mode connector and a published directory app. When the model requested a user confirmation, it initiated the flow through the first connector, whose widget issued a one-time confirmation code after the user approved. The follow-up tool call, however, was silently routed through the second connector. Because the code was bound to the first connector's OAuth client, the server rejected every attempt. The author argues this matters beyond the immediate failure: connectors are separate apps with separate OAuth grants, so a silent switch passes data between apps without user consent. While both connectors here came from the same provider and server-side binding blocked the call, a third-party connector sharing the server URL could receive another provider's data. The piece concludes that the app boundary should be defined by the connector and its OAuth client, not a shared MCP server URL, and that follow-up calls should stay on the connector that started the flow.