--- title: ChatGPT silently passes data between connectors and the... description: ChatGPT can silently route a follow-up tool call through a different connector than the one that started the flow, without telling the user. With two... canonical: https://daily.dev/posts/chatgpt-silently-passes-data-between-connectors-and-the-bounty-wants-an-id-card-uockb1enn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ChatGPT silently passes data between connectors and the bounty wants an ID card | daily.dev og:description: ChatGPT can silently route a follow-up tool call through a different connector than the one that started the flow, without telling the user. With two... og:url: https://daily.dev/posts/chatgpt-silently-passes-data-between-connectors-and-the-bounty-wants-an-id-card-uockb1enn og:image: https://api.daily.dev/og/posts/uoCkB1eNn.png og:image:alt: ChatGPT silently passes data between connectors and the bounty wants an ID card og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ChatGPT silently passes data between connectors and the bounty wants an ID card **[Hacker News](https://daily.dev/sources/hn)** · 3 min read · 0 upvotes · 0 comments ## Summary ChatGPT can silently route a follow-up tool call through a different connector than the one that started the flow, without telling the user. With two connectors pointing to the same MCP server, a confirmation code generated by connector A's widget was redeemed through connector B instead. The server rejected the call because the code was bound to connector A's OAuth client, so every attempt in that conversation failed. The report warns that with a third-party connector sharing the same server URL, the same silent switch could pass one app's data to another provider, since the real boundary is the OAuth client, not the URL. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Can ChatGPT route a tool call to the wrong MCP connector without telling the user? Yes, in a documented case ChatGPT made a follow-up tool call through a different connector than the one that started the flow, with no notification to the user. The call carried a one-time confirmation code generated by the first connector's widget, but it was redeemed through the second connector's OAuth client, which caused the server to reject it. _Developers wiring up MCP connectors can track emerging ChatGPT Apps SDK security reports on daily.dev._ ### Is a shared MCP server URL enough to treat two ChatGPT connectors as the same app? No, a shared URL is not sufficient because a server can act for different parties behind the same URL, such as separate tenants, partners, or environments. The real boundary between connectors is the OAuth client each one uses, not the server URL, so tool calls should be matched by OAuth client rather than URL. _Anyone designing multi-tenant MCP servers can follow connector security findings like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 39 comments across hackernews (as of 2026-11-07). **TL;DR:** Most of the discussion pivots away from the technical connector-leak bug itself and into anger over OpenAI's bug bounty now requiring ID verification before submitting reports, with many seeing it as a chilling, privacy-hostile barrier; a few technical commenters also argue the underlying confirmation-binding assumption was never actually guaranteed by the architecture. **Sentiment:** 5% positive · 25% mixed · 70% skeptical **The case for** - Some argue mandatory ID verification is a reasonable anti-spam measure against AI-generated low-quality submissions. - One commenter notes ID requirements were always there for payout/compliance purposes, just moved earlier in the process. **The pushback** - Many object to requiring biometric/ID data upfront, arguing it discourages legitimate anonymous or privacy-conscious researchers. - Several say onerous reporting requirements (NDAs, long embargoes, low payouts) push researchers toward public disclosure or selling vulnerabilities elsewhere instead. - One technical commenter argues the whole premise is flawed since MCP tool calls have no real scoping or binding once control returns to the model. - Distrust is expressed toward the identity-verification vendor's ownership ties. - Some see the whole report itself as having obvious LLM-generated phrasing, questioning its quality. **By community** - hackernews (heated): Discussion splits between defending anti-spam ID verification and strongly criticizing it as privacy-invasive, with side arguments about whether the technical bounty claim even holds up and jabs at AI-generated writing. **Hottest debate:** Whether requiring ID verification for bug bounty submissions is a legitimate anti-spam measure or an invasive barrier that will drive away serious anonymous researchers. **Open questions** - Does OpenAI's confirmation-code flow actually offer any real binding/scoping guarantee once control passes back to the model, or was that assumption always wrong? - Will stricter identity verification meaningfully reduce AI-generated spam reports given AI can also comply with stated rules? **Highlights** > No. All bounty programs allowed submissions without ID, compliance came into play only if you were given a reward and decided to accept it. This was moved to the front of the reporting process specifically to combat AI-generated vuln report spam - basically, requiring you to "burn" your real ID if you're submitting slop. Kinda ironic that this is now preventing people from submitting security reports to AI companies. > — [uptrails on hackernews · 1 comments](https://news.ycombinator.com/item?id=50399896) > The last 2 vulns I found, I sold on Tor. The companies can pay market value. Someone will. No I won't sign an NDA. No, I won't sign your obscene contract. No, I won't agree to a 90/120/180/360 day embargo. No, I don't care about your customers or shareholders. Simply put: fuck you, pay me. Or, find out. > — [nekusar on hackernews · 1 comments](https://news.ycombinator.com/item?id=50400461) > This seems like a fundamental misunderstanding / over estimation of the guarantees OAI and MCP can offer. If 'confirmation' is a separate tool call ... it's a separate tool call. There's no scoping, there's no 'binding', nothing. When you hand control back to the model you hand control back to the model. > — [kristjansson on hackernews](https://news.ycombinator.com/item?id=50399789) > They use Persona, which is heavily invested-in by Peter Thiel's Founder's Fund. Peter Thiel, of Palantir (funded initially by In-Q-Tel, the CIA's VC arm). No shit security researchers don't want to give ID scans and biometric data to them. > — [edot on hackernews](https://news.ycombinator.com/item?id=50400008) > Heck, even just perfectly comfortable whitehats will just get fed up with overly onerous reporting requirements and disclose publicly (like here). > — [phyzome on hackernews · 1 comments](https://news.ycombinator.com/item?id=50400144) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50399569) · 74 points · 39 comments ## Similar posts on daily.dev - [Amazon Quick adds new tool settings and Model Context Protocol \(MCP\) sync support for connectors](https://daily.dev/posts/amazon-quick-adds-new-tool-settings-and-model-context-protocol-mcp-sync-support-for-connectors-lgt7vb6ql) · AWS · 0 upvotes · 0 comments - [MCP Gateway for AI Agents: Connecting AI Agents to SaaS Tools Without Sharing Your Credentials using DigitalOcean Action Gateway](https://daily.dev/posts/mcp-gateway-for-ai-agents-connecting-ai-agents-to-saas-tools-without-sharing-your-credentials-using-efto06ch8) · DigitalOcean Community · 1 upvotes · 0 comments - [AI Coding Agents Are Leaking Credentials on Endpoints](https://daily.dev/posts/ai-coding-agents-are-leaking-credentials-on-endpoints-3xkdxyadx) · GitGuardian · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#chatgpt](https://daily.dev/tags/chatgpt), [#mcp](https://daily.dev/tags/mcp), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/chatgpt-silently-passes-data-between-connectors-and-the-bounty-wants-an-id-card-uockb1enn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ChatGPT silently passes data between connectors and the bounty wants an ID card","url":"https://daily.dev/posts/chatgpt-silently-passes-data-between-connectors-and-the-bounty-wants-an-id-card-uockb1enn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/chatgpt-silently-passes-data-between-connectors-and-the-bounty-wants-an-id-card-uockb1enn"},"datePublished":"2026-11-07T00:27:14.477Z","dateModified":"2026-11-07T02:43:04.590Z","description":"ChatGPT can silently route a follow-up tool call through a different connector than the one that started the flow, without telling the user. With two...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5d38f220cde86ee1998141af22f81eff?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5d38f220cde86ee1998141af22f81eff?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/chatgpt-silently-passes-data-between-connectors-and-the-bounty-wants-an-id-card-uockb1enn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,chatgpt,mcp,oauth","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"ChatGPT silently passes data between connectors and the bounty wants an ID card"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/chatgpt-silently-passes-data-between-connectors-and-the-bounty-wants-an-id-card-uockb1enn#faq","mainEntity":[{"@type":"Question","name":"Can ChatGPT route a tool call to the wrong MCP connector without telling the user?","acceptedAnswer":{"@type":"Answer","text":"Yes, in a documented case ChatGPT made a follow-up tool call through a different connector than the one that started the flow, with no notification to the user. The call carried a one-time confirmation code generated by the first connector's widget, but it was redeemed through the second connector's OAuth client, which caused the server to reject it. Developers wiring up MCP connectors can track emerging ChatGPT Apps SDK security reports on daily.dev."}},{"@type":"Question","name":"Is a shared MCP server URL enough to treat two ChatGPT connectors as the same app?","acceptedAnswer":{"@type":"Answer","text":"No, a shared URL is not sufficient because a server can act for different parties behind the same URL, such as separate tenants, partners, or environments. The real boundary between connectors is the OAuth client each one uses, not the server URL, so tool calls should be matched by OAuth client rather than URL. Anyone designing multi-tenant MCP servers can follow connector security findings like this on daily.dev."}}]} ```