AI connectors keep mutating: the tools you approved aren't the ones you run

What is this?

In mid-July 2026, the security firm PromptArmor published a study of the connectors that link ChatGPT and Claude to outside services such as Gmail, Slack, Dropbox and Zoom. The headline finding, reported by The Register on 19 July and by The Next Web on 20 July, is that these integrations do not sit still. Across the population PromptArmor tracked, a connector changed on average roughly every nine minutes.

The point is not that any single connector was caught behaving maliciously. It is a structural one: when you approve a connector, you approve a snapshot of what it can do. That snapshot expires almost immediately, and nothing forces the system to ask you again when it changes.

How it works

A connector advertises its capabilities to the model through tool definitions — a tool’s name, its natural-language description, and its input schema. The model reads those definitions to decide when to call a tool and with what arguments. Crucially, the description is what tells the model when to act. This is the same surface exploited by a tool-description rug pull, where a definition is rewritten after approval to redirect the model’s behaviour.

PromptArmor’s contribution is to show how much this surface moves in normal operation, at ecosystem scale. Of 2,517 connectors it tracked over six weeks from mid-May to the end of June, 931 — about 37% — changed. Vendors added 1,686 new tools onto connectors that were already live, and rewrote 1,127 tool descriptions. A single connector can expand dramatically: the Dropbox connector alone grew from eight tools to twenty-four, and from zero tools that can destroy data to four. Roughly two in five Claude connectors call other AI services in turn, so a request can fan out beyond the vendor you thought you were talking to — the Zoom connector’s meeting search could route a query to any of ten AI subprocessors across eight model families. No exploit is reproduced here; the mechanism is the mutability itself.

Why it matters

This is a classic time-of-check to time-of-use gap, applied to agent tooling. Security has traditionally worked by constraining what software can do and reviewing that constraint. An agent’s whole value is that it can do almost anything on your behalf, and a connector’s capabilities are fetched from the vendor at runtime rather than pinned to what you reviewed. The map you approved on Monday may not describe the system you run on Friday.

The risk compounds with the lethal trifecta that Simon Willison named: private-data access, exposure to untrusted content, and a channel to send data out. A connector that silently gains a destructive tool, a new exfiltration-capable action, or an extra downstream AI subprocessor can move an agent from two of those three properties to all three — the exact boundary that Meta’s Agents Rule of Two says should require a human in the loop. Because the change arrives through a normal vendor update rather than a visible prompt, it is invisible to input filters and to the person who clicked “connect” weeks earlier.

Defenses

Treat connector and tool definitions as pinned dependencies, not as a live feed to be trusted implicitly. Record the exact tool set, descriptions and schemas at approval time, diff them on every change, and surface the diff for review — especially additions of tools that can delete, send, or call other models. Re-request consent when a connector’s capabilities expand rather than letting new tools inherit the old grant. Prefer allowlisting individual tools over trusting a whole connector, apply least privilege so a connector cannot silently acquire a destructive action, and constrain or log the downstream subprocessors a request may reach so sensitive data does not fan out to model families you never vetted. Above all, log every tool call with its resolved definition so a behaviour change can be traced back to the update that caused it. The OWASP GenAI project tracks these supply-chain and tool-integration risks and is a useful checklist for building these controls in.

Status

Item	Detail
Disclosure	PromptArmor study, mid-July 2026; covered by The Register (19 Jul) and The Next Web (20 Jul)
Nature	Empirical measurement of connector/tool-definition churn in the Claude and ChatGPT ecosystems
Scale	2,517 connectors tracked; 931 (~37%) changed over six weeks; ~one change every nine minutes on average
Notable changes	1,686 new tools added to live connectors; 1,127 tool descriptions rewritten; Dropbox connector 8→24 tools (0→4 destructive)
Fan-out	~2 in 5 Claude connectors call other AI services; one connector’s query could reach 10 subprocessors across 8 model families
Class	Supply-chain / time-of-check-to-time-of-use trust gap in mutable agent tooling

Figures reflect PromptArmor’s measurements over a specific six-week window and will drift as vendors keep shipping. Verify the current tool set of any connector you depend on rather than relying on the state you approved.