Third-party connectors broaden security risks for AI agents, study warns

Integrations that allow AI assistants to access services such as Gmail, Slack, Dropbox or Zoom may substantially increase the security risks associated with agentic systems, according to an analysis from AI security company PromptArmor.

The concern centers on the combination of private information, untrusted content and the ability to communicate externally—a pattern sometimes described as the “lethal trifecta.” Connectors can give an agent access to all three, while also introducing additional tools, permissions and service providers that organizations may not have assessed.

Capabilities changed rapidly

PromptArmor reviewed connectors used by OpenAI’s ChatGPT and Anthropic’s Claude. It reported that 931 of 2,517 connectors, or 37 percent, changed during a six-week period from mid-May through the end of June. Those changes included 1,686 newly added tools and 1,127 rewritten tool descriptions.

Such updates can alter what an agent is able to do and influence when a model chooses to invoke a tool. The report cited Dropbox as an example: its connector grew from eight tools to 24 during the study. Write-capable tools increased from three to 10, while potentially destructive tools rose from none to four. Permission scopes and model-facing instructions also changed.

Connectors may call other AI services

The analysis also found that connectors can pass information to additional AI providers. PromptArmor examined 7,517 tools across 487 Claude connectors and estimated that 189 connectors—roughly two in five—were likely to contact external AI services.

For example, a meeting-search request sent through a Zoom connector could be processed by Zoom’s AI systems and subprocessors. That means an organization approving Claude or a connector may not realize that data is being transferred to other models, vendors or jurisdictions under separate policies and contractual terms.

Anthropic’s documentation notes that connected services process information on their own infrastructure. Controls governing where Claude itself performs inference do not necessarily constrain those third-party services.

Security teams can reduce exposure by inventorying connector tools and permissions, monitoring changes, reviewing downstream processors and limiting access to sensitive data and high-impact actions. The findings also underscore the need to treat connectors as evolving software dependencies rather than fixed features.