ChatGPT silently passes data between connectors and the bounty wants an ID card

Who Should Read

Backend developers building multi-step tool flows with confirmation codes and OAuth on ChatGPT Apps SDK or MCP servers

Core Mechanics

• Follow-up call went to another connector
  • In a conversation with two connectors, the follow-up call for a flow started on A went through B.
  • The user was never told about the switch.
• One-time confirmation code traveled along
  • The code sent by A's widget via ui/message was carried in the call through B.
  • The author says this passes data between apps without user consent.
• Server rejected it, so it failed
  • The code was bound to connector A's OAuth client, so redeeming via B was refused.
  • Every attempt in that conversation failed.
• Repro uses two connectors on one MCP server
  • A is a developer-mode custom connector and B is the published directory app.
  • Each has its own OAuth client, so the server sees two clients for one user.
• OAuth client is the boundary, not the URL
  • Behind one MCP URL a server can act for different tenants, partners or environments by OAuth client.
  • The author argues tool calls should match connectors by OAuth client, not server URL.
• Bounty submission blocked by ID demand
  • The program required biometric ID and an ID card before submitting, which the author refused.

Community Reactions

• Opinion that bounty ID checks are platform policy
  • A commenter first assumed sanctions compliance, then cited Bugcrowd docs making IDV mandatory to cut low-quality reports.
• Pushback that confirmation is just another tool call
  • A commenter said there is no scoping or binding, and handing control to the model means handing it to the model.
  • They think OpenAI and MCP guarantees are overestimated.
• Reaction that the techsoft.ye reply read like an LLM
  • Commenters criticized it as long with nothing useful.
• Extreme comment about selling vulns on the black market
  • One commenter claimed to sell vulnerabilities on Tor, refusing NDAs and embargoes.

How to Apply

• Bind confirmation codes to the OAuth client
  • Today, store client_id, user and operation ID with each issued code.
  • Reject at verification if any of the three mismatch.
• Audit per-client behavior behind one MCP URL
  • If you expose one server through several connectors, list permissions and tenant branching per OAuth client.
  • Check access control per client, not per URL.
• Log connector switches
  • Record the client_id seen at confirmation and at the follow-up call.
  • Never log the code value itself.
• Make codes short-lived and single-use
  • Set a short expiry and invalidate on first use.
  • Assume values a widget posts to the conversation can reach other connectors.

Try It

# Paste into Claude or ChatGPT (review of MCP server confirmation code design)

Below is our MCP server's confirmation code issue and verify code.
{{code}}

Check for weaknesses using these criteria.
1. Is the code bound to the issuing OAuth client_id, user and operation?
2. Is it rejected when used with a different client_id?
3. Is it single-use with a short lifetime?
4. Is the code value kept out of logs?

Next: write fixes for the gaps and test cases for client_id mismatch.

Terminology

Related Papers

• How I Fight AI Brain Fry

  Keeping tickets in git and deciding in one inbox tamed my 20-thread agent chaos

• Goldman Sachs is pulling Claude Code from its bankers and traders

  Goldman limits coding agents to engineers, cutting off traders and bankers

• Agent memory needs its OpenTelemetry moment

  Agent memory formats are fragmented, so this post proposes an OpenTelemetry-style shared spec.

• Goodbye Claude, hello Pi

  Frequent system prompt changes and token overhead pushed one dev from Claude Code to Pi.

• The Components of Agent Memory

  Giving Claude a memory folder plus dreaming lifted document QA scores from 13% to 48%

• Claude Code sends your email address to websites

  Claude Code put users' emails in curl User-Agent headers, prompting spam complaints and a built-in blocking mod

• Launch HN: Rivet (YC W23) – Scale and Orchestrate Agents on S3

  Running each agent as an Actor gave 4.99 ms p99 cold starts and 72 KB RAM per instance.

• Show HN: Stroq – a local audit of what your coding agent did and why

  Stroq finds leaked keys in agent sessions and traces risky commands to their source before they run

Related Resources

• https://community.openai.com/t/security-follow-up-tool-call-silently-routed-to-a-different-connector/1413053
• https://docs.bugcrowd.com/researchers/managing-account/