Why it mattersA team running an MCP server behind two ChatGPT connectors must bind every operation to the OAuth client. The server URL is no longer enough.
A developer who runs an MCP server behind two ChatGPT connectors has one thing to check this weekend. A researcher called AldiPower posted a security write-up on OpenAI's developer community forum. The post is dated 5 November. AldiPower says ChatGPT sent a follow-up tool call through a different connector than the one that opened the flow. The call carried a one-time confirmation code from the first connector's widget.
The write-up includes a reproducible sequence. One ChatGPT account has two connectors enabled that point to the same MCP server. One is a custom connector added in developer mode. The other is the published app from the app directory. Each has its own OAuth client.
The sequence AldiPower logged
The user asks for an action that needs a confirmation. The model calls a confirmation tool through connector A. The widget shows the change and the user confirms. The widget sends a one-time code to the conversation. The model then makes the follow-up call with that code. ChatGPT sends the call through connector B.
AldiPower says every attempt in that conversation failed, because the server bound the code to connector A's OAuth client. The server rejected the call when connector B tried to redeem the code. In the attempt the post logs, the code was confirmed through connector A and redeemed through connector B. Nothing told the user that the follow-up call went to another connector.
Why it is a problem even when the server says no
Both connectors came from the same provider in AldiPower's test, so a server-side rule stopped the call. AldiPower says a third-party connector enabled in the same conversation would see the same silent switch. A shared MCP URL can serve different tenants, partners or environments, each a separate OAuth client. The boundary is the connector with its own OAuth client, not the server URL.
A second poster on the thread, techsoft.ye, writes that the server-side rule worked here. They say the design question is still open. Their advice: bind every pending operation to the connector that opened it. Block an automatic connector switch during a confirmation. Ask for the user's approval if a switch has to happen. Log every connector routing decision in traces.
What OpenAI has said
OpenAI has not posted a reply in the thread as of this writing. AldiPower says they tried the bug bounty program first. They did not submit the report there. The process asks for an identity check and a government-issued ID. The researcher chose the public community forum instead. Hacker News discussion of the write-up is at item 50399569 with 66 points.
A team that runs an MCP server behind more than one ChatGPT connector has a short checklist. Bind every short-lived confirmation code to the OAuth client that produced it. Reject a redemption from a different client, which is what AldiPower's server did. Log the OAuth client on every tool call so a connector switch is visible after the fact. Treat a shared MCP URL as a route, not as an identity.
Source
- Security: Follow-up tool call silently routed to a different connector, AldiPower, on the OpenAI Developer Community forum.
- Hacker News thread, item 50399569.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
