https://www.promptarmor.com/resources/claude-and-gpt-connectors-change-every-9-minutes
Security researchers at PromptArmor have published findings revealing that connectors, the integrations allowing AI assistants like ChatGPT and Claude to interact with third-party services such as Gmail, Slack, Dropbox and Zoom, are dramatically expanding the attack surface of enterprise AI deployments in ways that most security teams are poorly positioned to track. The research examined how connectors built on MCP servers behave in practice, finding that 931 of 2,517 connectors, representing 37 percent of the total, changed in some way during the six-week period between mid-May and the end of June alone. During that same window, 1,686 new tools were added to already-live connectors, and 1,127 tool descriptions were rewritten, potentially altering when and how AI models choose to invoke them. The Dropbox connector was cited as a concrete example: at the start of the study it exposed eight tools including three with write capability and none with destructive potential; by the end it exposed 24 tools, ten with write capability and four capable of destructive actions, alongside new injected model instructions and changed permission scopes.
A further concern identified is that connectors frequently route user data through additional AI services that organisations have not evaluated or approved. Analysis of all 7,517 tools across 487 Claude connectors found that approximately two in five connectors are likely to call additional AI services downstream. As an example, the researchers noted that using Zoom’s natural language meeting search tool through a Claude agent could result in query data containing sensitive information being passed to any of Zoom’s ten AI subprocessors across eight different model families. Anthropic’s own connector documentation acknowledges this gap explicitly, noting that connected services process data under their own terms and infrastructure, and that enterprise settings controlling where Claude’s inference runs do not affect where third-party services operate.
PromptArmor described the cumulative effect as an explosion in blast radius, warning that connectors simultaneously introduce new sensitive data, new untrusted data, and new sensitive actions into the AI agent’s operational context. The researchers previously demonstrated this risk in the context of OpenAI’s Codex, showing that even a single email connector was sufficient to enable exfiltration of legal and financial communications through prompt injection. The findings underline a broader structural problem for enterprise AI governance: security assumptions based on a connector’s declared capabilities at the time of approval may be rendered invalid by silent updates, leaving organisations exposed without any notification that the risk profile of an approved integration has materially changed.