A developer using the handle AldiPower wrote on OpenAI’s developer forum on 5 November that ChatGPT switched connectors mid-workflow while calling an external service. The thread also reached Hacker News. It contains no reply from OpenAI.

A connector gives ChatGPT access to an external service’s tools through an MCP server.

Confirmation code ended up in the other connector’s call

The developer had two connectors to the same MCP server on one ChatGPT account: connector A, added in developer mode, and app B, published in the app directory. Each had its own OAuth client, so the server saw two separate clients for the same user.

The user requested an action that requires confirmation. The model called the confirmation tool through connector A, and the connector’s widget, embedded in the conversation, displayed the change. When the user confirmed it, the widget sent a one-time confirmation code to the conversation. The model then sent the code in a follow-up call through connector B without telling the user about the switch.

The server rejected the call because the code was bound to connector A’s OAuth client. Every attempt in that conversation failed, the developer said. In the attempt logged in detail, the code was confirmed through connector A and redeemed through connector B.

The switch moves data produced by one app to another without the user’s consent, the developer said. In this case both connectors came from the same provider, so the server’s own check stopped the call. If a third-party connector with the same server URL were in the same conversation, the same switch could send data to another provider, the developer said. This is AldiPower’s assessment, not an observed case.

In AldiPower’s view, a shared MCP URL does not make two connectors one. Behind a single URL, the server can act for different parties depending on the OAuth client, such as different customer organisations or environments. AldiPower believes ChatGPT should match a tool call to a connector by its OAuth client rather than by URL, and make the follow-up call through the same connector as the initial call.

Report not filed because of personal data requirement

Another forum user, techsoft.ye, urged reporting the finding through OpenAI’s coordinated vulnerability disclosure process. The same user also asked whether the connector switched while the confirmation was being processed or only when the model chose the follow-up call. No one in the thread answered the question.

In reply, AldiPower wrote of trying to report the issue to OpenAI’s bug bounty programme. The programme requires personal data, such as biometric identification and an ID card, before a report can be submitted, and the data must also be given to an outside party, AldiPower wrote. AldiPower said of being unwilling to provide it.