The integration of AI agents with third-party services through "connectors" significantly amplifies the security risks associated with AI models, according to a recent analysis by PromptArmor, an AI security firm. These connectors, which enable AI models like OpenAI's ChatGPT and Anthropic's Claude to interact with services such as Gmail or Slack, introduce a complex web of data flows and functionalities that challenge traditional security assessments.
PromptArmor's study, conducted over a six-week period from mid-May to the end of June, revealed a high rate of change within the connector ecosystem. Out of 2,517 connectors examined, 931 (37 percent) underwent modifications. These changes included the addition of 1,686 new tools to existing connectors, the rewriting of 1,127 tool descriptions, and alterations to permission scopes and injected instructions for the AI models. Such frequent updates mean that security assumptions based on initial capabilities may quickly become outdated.
As an example of this evolving risk, PromptArmor cited the Dropbox connector, which expanded from exposing eight tools at the beginning of the study to 24 by its conclusion. This increase included a rise from three write-capable tools to 10, and from zero potentially destructive tools to four.
A key concern highlighted by PromptArmor is that connectors often transmit data to additional, undisclosed AI services. The firm evaluated 7,517 tools across 487 Claude connectors and found that 189 of them, approximately two out of five, are likely to invoke other AI services. This means that when an AI agent uses a connector, sensitive data might be processed by multiple subprocessors and different AI model families, often without the user's or the approving team's knowledge. For instance, if a Claude agent uses a Zoom connector to search meetings with sensitive data, Zoom AI might send that data to any of its ten AI subprocessors to generate a response from one of its eight model families.
Anthropic's own connector documentation acknowledges this limitation, stating that connected services process data on their own infrastructure and under their own terms, which may be located outside the United States. This means that security controls applied to Claude's inference, such as US-only inference settings on Enterprise plans, do not extend to the operations of third-party services.
The security implications of connectors are substantial, as they introduce new avenues for sensitive data exposure, interaction with untrusted content, and external communication paths. The combination of sensitive and untrusted data, coupled with new actions an AI agent can take, significantly expands the potential "blast radius" of an attack. Previous research has shown that even with a single connector, like email, the interplay of sensitive and untrusted data can facilitate the exfiltration of confidential communications.
