Security researchers have identified a critical flaw in the ChatGPT Apps SDK where follow-up tool calls are silently routed to a different connector than the one that initiated the flow. In a test scenario with two connectors enabled—Connector A (a custom connector) and Connector B (a published app)—the model successfully called a confirmation tool through Connector A and received a one-time confirmation code. However, the follow-up call was made through Connector B without informing the user.
The server rejected the call because the confirmation code was bound to Connector A's OAuth client. This silent switch passes data from Connector A to Connector B without the user's consent, exploiting the fact that each connector has its own OAuth client even when pointing to the same MCP server. The server-side binding that should prevent this cross-connector interaction fails because the OAuth client identity is the actual boundary, not the shared URL.
Expected behavior requires tool calls to be matched to connectors by their OAuth client, ensuring each follow-up call stays within the same connector's context. This security vulnerability could allow data to flow between separate apps without user awareness, posing a significant risk.
Source: Hacker News · Summarized by HeadlinesBriefing