Connector Volatility Undermines Security Assumptions
Integration of AI agents with external services through connectors introduces a new level of security challenge. PromptArmor warns that connectors, for example for Gmail or Slack, grant models access to private data, unverified content and external communication paths, which complicates traditional defensive approaches. Shankar Krishnan of PromptArmor emphasises that this combination of “three deadly risks” significantly increases the likelihood of data leakage or misuse.
The research examined 2 517 tracked connectors for ChatGPT and Claude over six weeks from mid‑May to late June and found that 931 of them (37 %) underwent substantial changes. This means any security assumptions based on previously declared capabilities may cease to hold within weeks. PromptArmor also identified 1 686 new tools added to already functioning connectors and 1 127 tool descriptions that were rewritten, which can alter when and how a model decides to use a tool.
One of the most striking cases is the Dropbox connector. At the start of the study it exposed eight tools, but during the monitored period the count rose to 24. The number of tools with write capability grew from three to ten and the number of potentially destructive tools increased from zero to four. These changes included permission modifications and the insertion of instructions that the model executes automatically.
Hidden Third-Party AI Calls Bypass Enterprise Controls
Similarly PromptArmor discovered that of 487 Claude connectors using a total of 7 517 tools, 189 (approximately two in five) likely call additional AI services. For example, when activating the Zoom connector the model may pass a sensitive query to Zoom AI, which further redistributes the data among up to ten subprocessors and eight different model families.
Anthropic security documentation explicitly states that model control mechanisms do not apply to third‑party data processing. “Connected services process data on their own infrastructure, under their own terms, which may be located outside the United States,” the company stated. This means settings such as US‑only inference on enterprise plans do not affect where or how third parties process data. Krishnan warns that such hidden calls to external AI services can escape notice during routine connector approval processes.
Agent Data Injection Adds Memory Manipulation Risk
At the same time related threats linked to agent data input are appearing in specialist literature. Researchers from Czech technology publication Root.cz describe a technique called “agent data injection” in which an attacker inserts false information, for example via email, into an agent’s memory without the user detecting the change. In laboratory tests such deception succeeded in 87,5 % of cases for the open‑source agent OpenClaw and in 71,4 % for an agent built on the Claude Code SDK. The authors recommend separating the reading of untrusted emails from writing to persistent memory and requiring user confirmation for every write. These findings show that controlling only input prompts is insufficient, it is necessary to verify the data from which the agent draws.
Governance Implications for Enterprise Deployments
Companies deploying AI agents with connectors must extend their audit framework to include monitoring of connector changes, permission control and transparency of third‑party AI service calls. Insufficient visibility and frequent updates can invalidate existing security settings and disrupt compliance with internal governance. Implementation of stricter processes for approval and monitoring of data flows is essential to limit the expanded attack surface.