A developer reports that ChatGPT can silently switch connectors midway through a confirmed action. In a conversation with two connectors pointing to the same MCP server but using separate OAuth clients, the initial confirmation tool ran through Connector A. Its widget displayed the requested change, and after the user approved, it sent a one-time confirmation code into the conversation. ChatGPT then made the follow-up call through Connector B, carrying that code without notifying the user. The server rejected the request because the code was bound to A’s OAuth client; repeated attempts failed. The report argues that a shared server URL does not make connectors interchangeable: distinct OAuth clients can represent different tenants, partners, or environments, so routing data between them may cross an authorization boundary.
A participant agrees that server-side code binding prevented the attempted redemption but says this does not address the silent routing itself. They argue that multi-step workflows should retain the originating connector and authorization context, prevent automatic switching, and require user approval for any change. They also recommend server-side validation of confirmations and diagnostic traces of routing decisions, and ask whether the connector changed during confirmation handling or only when the follow-up tool was selected. The original reporter says they tried to submit the issue through the bug bounty program but would not provide personal data, including biometric identification and an ID card, to a third party as a condition of submitting a report.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A URL-encoding flaw in Hugging Face Chat let unauthenticated requests bypass an admin check and trigger bulk exports of users’ private conversations. The exported data was sent to a configured dataset destination rather than returned directly to the requester. (twitter.com)
Claude Code’s “Don’t Ask Again” setting was linked to passwords and other secrets being exposed in 1,122 public GitHub files. The finding highlights how coding-agent features can accidentally put sensitive data into public code repositories. (apiiro.com)
Hackers stole $133 million from a French bank by targeting a service provider. The available details do not explain how the attack was carried out. (bleepingcomputer.com)
U.S. intelligence reportedly believes Nvidia CEO Jensen Huang had a romantic relationship with suspected Chinese spy Alice Huang, who allegedly sought access to restricted AI chips. Alice Huang is linked to Megaspeed, whose subsidiary faces allegations of smuggling $2 billion in AI chips into China. (tomshardware.com)
A report alleges China is linked to at least 18 overseas police stations in Canada, including three in the Greater Toronto Area. The RCMP is investigating reports of criminal activity connected to the stations. (ctvnews.ca)
Colframe is a low-interaction honeypot that imitates supermarket refrigeration controllers from Danfoss and Dixell. It is designed to attract and observe activity targeting these systems, including Modbus-based threats. (github.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.