PromptArmor’s Connector Study Turns AI Agent Permissions Into a Moving Target

AI agents that connect to Gmail, Slack, Zoom, or Dropbox do not just gain new capabilities, they inherit whatever risk lives inside each service they touch. New research from AI security firm PromptArmor, reported this week by The Register’s Thomas Claburn, found that the connectors linking Claude and ChatGPT to outside services change constantly and often silently, which means the access a security team approved on day one rarely matches what is actually running weeks later.

Security researchers commonly describe a foundational AI agent danger as the “lethal trifecta”: an agent that can access private data, process untrusted content, and communicate externally all at once needs only one malicious instruction hidden in that untrusted content to leak the private data back out. PromptArmor’s research argues that connectors make this danger far harder to reason about than the trifecta framing alone suggests, because a connector is not a fixed, one-time grant of access. It is a living piece of software that a third-party vendor can change at any time.

What a Connector Actually Connects

A connector is Anthropic and OpenAI’s name for an integration that lets an AI agent call out to a third-party service such as Gmail, Slack, Zoom, or Dropbox during a conversation or task. Under the hood, a connector is a wrapper around an MCP server, built on the Model Context Protocol that Anthropic introduced in 2024 as an open standard for linking AI models to external tools and data sources. The Register notes that connectors “share some of the risks of MCP servers, upon which connectors are based,” and Anthropic’s own help center documentation confirms the same architecture, describing a connector as a wrapper around an MCP server.

Connectors for Claude and ChatGPT are roughly a year old, and PromptArmor cofounder Shankar Krishnan told The Register that rising enterprise adoption, combined with the pace of change inside the connector ecosystem, is what pushed the firm to study it closely. “For connectors, the risks are mostly about the type of tools, what they can do, where the data is going, and what is being done with the data,” he said.

Permissions That Do Not Stay Put

PromptArmor tracked 2,517 connectors over a six-week window from mid-May to the end of June 2026 and found that 931 of them, or 37 percent, changed in some way during that period. Across those changes, connectors that were already live gained 1,686 new tools, and 1,127 existing tool descriptions were rewritten outright, meaning the plain-language explanation an AI model reads to decide when and how to use a tool was altered after a security team had already reviewed and approved it. Any assumption a governance team made based on a connector’s declared capabilities at approval time can be invalidated by the vendor days or weeks later.

Dropbox’s Growth Curve

PromptArmor’s Dropbox findings illustrate how far a single connector can drift. At the start of the study, the Dropbox connector exposed eight tools to a connected agent. By the end, that had risen to 24. Write-capable tools, meaning tools that can create or modify data rather than just read it, grew from three to 10. Potentially destructive tools, capable of deleting or overwriting data, went from zero to four. Permission scopes changed during the same window, and Dropbox added injected instructions that get fed into the model’s context alongside the tool descriptions.

Connectors Call Their Own AI Services

PromptArmor’s second finding concerns where connector data actually goes once an agent uses it. Evaluating 7,517 tools across 487 Claude connectors, the firm found that 189 of them, roughly two in five, are likely to call additional AI services of their own when invoked, similar to how a tracking-heavy website quietly loads scripts from dozens of other domains. Krishnan offered Zoom as a concrete example: if a Claude agent uses Zoom’s connector to search meeting content with a natural-language query and that query contains sensitive data, Zoom’s own AI systems may route that data to any of 10 AI subprocessors it uses across eight different model families to generate a response.

“The issue is that most teams approving connectors are evaluating and considering the connector, unaware that the vendor is calling more AI services, adding new subprocessors and terms,” Krishnan told The Register. A review that focused only on Zoom as the connector vendor would miss every AI subprocessor sitting behind it, along with whatever data-handling terms each of those subprocessors separately imposes.

What Anthropic’s Own Documentation Admits

Anthropic does not hide this limitation. Its Claude help center states plainly: “Connected services process data on their own infrastructure, under their own terms, which may be located outside the United States.” The same page adds that “settings that control where Claude’s inference runs, like the US-only inference setting on Enterprise plans, don’t change where third-party services operate.” For enterprise customers who configured Claude for US-only inference specifically to satisfy a data-residency requirement, that is a significant carve-out: the guarantee covers Claude’s own inference, not the connected services, and not whatever AI subprocessors those services call on their own.

What Security Teams Should Take From This

Krishnan’s broader point is that connectors do not just add new sensitive data and new untrusted content to an agent’s reach, they add new sensitive actions the agent can take, and all three combine to widen what an attacker can do if something goes wrong. “Bringing agents new sensitive data, new untrusted data, and new sensitive actions to take, the blast radius of an attack explodes,” he said. He pointed to PromptArmor’s own prior research on OpenAI’s Codex, where the firm found that even a single connector, email, was enough to enable exfiltration of legal and financial communications once sensitive and untrusted data mixed together in the same context.

None of this means connectors are unusable. It means the security model has to match how connectors actually behave: not as a one-time approval, but as a live dependency that needs periodic re-review, the same way teams already treat software supply-chain risk. A connector approved in mid-May with eight low-risk tools and no destructive capabilities is not a fixed quantity. Six weeks later it can look nothing like what was approved, and unless someone is actively watching for that drift, the first sign of trouble may be the incident itself.