PromptArmor evaluated all 7,517 tools used by 487 Claude connectors and found that 189 of them, roughly 39%, are likely to call additional AI services operated by third-party vendors. The AI security firm published its findings on July 19, warning of a “lethal trifecta” where agents simultaneously access private data, process untrusted content, and maintain external communication paths, according to The Register.

The Zoom Example

PromptArmor co-founder Shankar Krishnan illustrated the risk with a specific case: when a Claude agent activates Zoom’s connector to search meetings with natural language, sensitive data in the query may be forwarded to any of Zoom’s ten AI subprocessors across eight different model families, according to PromptArmor’s analysis. Teams approving connectors evaluate Claude itself but may not realize the connector routes data to additional AI services with separate terms, privacy policies, and jurisdictions.

Anthropic’s own connector documentation acknowledges the gap. “Connected services process data on their own infrastructure, under their own terms, which may be located outside the United States,” Anthropic states, adding that enterprise settings controlling where Claude’s inference runs “don’t change where third-party services operate,” as reported by The Register.

Connectors Change Every Nine Minutes

The study tracked all connectors on Claude and ChatGPT from mid-May through the end of June. During that six-week window, 931 of 2,517 connectors (37%) changed their capabilities, permissions, or tool definitions, per PromptArmor. The rate of change averaged one connector modification every nine minutes.

Key findings from the study:

  • 1,686 new tools were added to connectors already live, creating new ways for AI models to operate on user data
  • 1,127 tool descriptions were rewritten, potentially changing when the model decides to invoke a tool
  • 664 tools changed their accepted inputs (a tool requesting an email address might now request name, address, and phone number)
  • 283 connectors began injecting custom instructions into the model’s context
  • 86 new OAuth permission scopes were requested, granting agents access to more data
  • 21 read-only connectors gained tools allowing agents to create, edit, or delete content in third-party apps
  • 50 connectors changed the endpoints they communicate over, potentially altering data processing guarantees

Dropbox, Slack, and Google Drive

PromptArmor tracked specific connector changes across major platforms. Dropbox went from 8 tools to 24, from 3 write-capable tools to 10, and from zero potentially destructive tools to four. Permission scopes changed and injected instructions were added, PromptArmor reported.

Slack’s connector grew from 14 tools to 32 and from 1 permission scope to 34. Miro expanded from 5 tools to 31, with write-capable tools jumping from 1 to 15. Google Drive went from 35 tools to 47, with destructive tools increasing from 9 to 16.

The Governance Problem

“Most teams approving connectors are evaluating and considering the connector, unaware that the vendor is calling more AI services, adding new subprocessors and terms,” Krishnan told The Register. The core challenge: security assessments made at approval time are invalidated by connector changes that happen silently, without notification or re-consent.

For enterprises deploying AI agents with SaaS connectors, this creates an audit burden that scales with the number of connected services. Every connector is a potential data pathway to unknown AI subprocessors operating under separate terms, in separate jurisdictions, processing data that may include sensitive enterprise communications, financial records, or customer information. The security posture of an agent deployment can shift beneath an organization without any visible change to the user interface.