What happened in this Tech story?

A reproduced ChatGPT test shows the assistant rerouting a user-approved tool call to a second connector without telling the user, handing one app's one-time confirmation code to another app with separate OAuth permissions.

What is a key fact in this story? (1)

**ChatGPT** silently switched a confirmed follow-up tool call from Connector A to Connector B without telling the user, even though the action had been approved in Connector A's MCP Apps widget.

What is a key fact in this story? (2)

**MCP Apps** widget generated the one-time confirmation code, delivered to the conversation via ui/message, and the model then carried that code into Connector B's call — passing data between separate apps with no user consent.

📎 SkimNews has covered ChatGPT 101+ times · see the file →

ChatGPT Silently Switches Connectors Mid-Flow — SkimNews

By Hacker News · Summarized & edited by Kapil Samant · 2026-11-06

Get the Tech newsletter

Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.

ChatGPT silently switched a confirmed follow-up tool call from Connector A to Connector B without telling the user, even though the action had been approved in Connector A's MCP Apps widget.
MCP Apps widget generated the one-time confirmation code, delivered to the conversation via ui/message, and the model then carried that code into Connector B's call — passing data between separate apps with no user consent.
OAuth client binding blocked the swap: the server rejected the call because the code was bound to Connector A's client, and every attempt in that conversation failed.
MCP server configuration is the trap — both connectors pointed at the same server, one a custom developer-mode connector and one a published app-directory app, yet the server saw two separate OAuth clients for the same user.
Connector A is where the follow-up should have stayed: the expected behavior is that tool calls match a connector by OAuth client rather than MCP server URL, because with a third-party connector sharing the URL the silent switch is expected to pass one app's data to another provider.

Why it matters: For developers exposing an MCP server to multiple apps, the OAuth client — not the shared server URL — is the isolation boundary. With two connectors in one chat, ChatGPT's silent switch hands one app's confirmation code to another, breaking calls and, where a third-party app shares the URL, sending data across providers without consent.