Every AI agent is only as safe as the walls around it. For the past two years, the industry has obsessed over model alignment, prompt injection, and jailbreaks. Those are real problems. But a new study from AI security firm PromptArmor suggests the bigger threat is not the model itself. It is the growing web of connectors that plug chatbots into Gmail, Slack, Dropbox, Zoom, and hundreds of other services. The moment an AI agent can read your email, edit your documents, and search your meetings, the security model stops being about the AI and starts being about everything it can touch.
Connectors are built on the Model Context Protocol (MCP), Anthropic’s standard for letting AI models interact with outside tools. They sound innocent enough: give Claude access to your Notion, let ChatGPT read your calendar, and the agent becomes more useful. But utility is a risk multiplier. PromptArmor found that over a six-week period from mid-May to the end of June, 931 of 2,517 connectors changed. That is 37 percent. The capabilities your security team reviewed on Monday may not be the capabilities running on Friday.
The Churn Is the Threat
The rate of change is the most disturbing part. During the study, PromptArmor observed 1,686 new tools added to connectors that were already live. Tool descriptions were rewritten 1,127 times. Permission scopes shifted. Injected instructions appeared. Any one of these changes can alter what data the model sees, what actions it can take, and which third parties receive the results.
The Dropbox connector is a perfect example of how quietly this happens. At the start of the study, it exposed eight tools. By the end, it exposed 24. It went from three write-capable tools to ten. It went from zero potentially destructive tools to four. The permissions changed. The model instructions changed. And yet, to a user, it still looked like “the Dropbox connector.” A security review that approved Dropbox access six weeks ago did not approve what Dropbox access means today.
This is not a bug in a single connector. It is the architecture of the ecosystem. Each connector is a moving target, and the security assumptions behind it expire almost as fast as the terms of service. Enterprises that treat connector approval as a one-time checkbox are going to be unpleasantly surprised.
The Third-Party AI Problem
If the connector itself were the only concern, the problem would be manageable. It is not. PromptArmor evaluated 7,517 tools across 487 Claude connectors and found that 189 of them — about two in five — likely call additional AI services. Your data may enter through Claude, but it can leave through a subprocessor you have never heard of, running a model you have not approved, in a country you have not reviewed.
PromptArmor’s example is vivid: a user asks a Claude agent with the Zoom connector to search meetings using natural language. The query contains sensitive data. Zoom AI then sends that data to any of ten AI subprocessors to generate a response from one of eight different model families. The team that approved Claude may not have approved Zoom AI. The team that approved Zoom AI may not have approved its subprocessors. And the user who typed the query almost certainly approved none of it.
Anthropic’s own documentation acknowledges this. Connected services process data on their own infrastructure under their own terms, which may be located outside the United States. Settings that control where Claude’s inference runs do not change where third-party services run. The fine print is honest. The problem is that nobody reads it before clicking “allow.”
The Lethal Trifecta
PromptArmor co-founder Shankar Krishnan describes the risk as a “lethal trifecta”: access to private data, exposure to untrusted content, and an external communication path. Each is dangerous on its own. Together, they are a blueprint for exfiltration. An agent that can read your email, receive a malicious instruction, and send data to a remote server is not a productivity tool. It is a data loss prevention nightmare wearing a friendly interface.
PromptArmor recently highlighted a risk in Codex where even a single email connector enabled the exfiltration of legal and financial communications. The combination of sensitive data and untrusted data is the key. Attackers do not need to compromise the model itself. They only need to convince the agent to forward a message, or summarize a document, or search for a keyword that returns a payload. The connector does the rest.
This is the new shape of enterprise AI risk. The attack surface is no longer the model weights or the inference endpoint. It is the entire connected graph of services, permissions, and subprocessors that the model can reach. And that graph is growing faster than any security team can map it.
What It Means for Enterprise AI Governance
Most organizations do not have a governance process for connectors. They have a governance process for SaaS apps. The difference is crucial. A SaaS app has a fixed feature set, a known vendor, and a defined data flow. A connector is a live integration that can change its behavior, add new subprocessors, and rewrite its own instructions without ever going through procurement. It is the difference between approving a tenant and approving a construction crew that can remodel the building every nine minutes.
Security teams need to start treating connectors as first-class risks. That means continuous monitoring, not one-time approval. It means automated drift detection when tools, permissions, or descriptions change. It means blocking write and destructive actions by default until there is a business need. And it means mapping the full chain of data processing, not just the first hop.
Vendors share responsibility here. Anthropic and OpenAI should make connector drift visible, not buried in logs. They should require explicit re-approval when a connector adds destructive tools or new subprocessors. They should make it easy for enterprises to see which models and countries their data is passing through. Right now, that transparency is missing.
🔥 Hot Takes
1. Connectors are the Shadow IT comeback nobody asked for. For years, enterprises tried to centralize SaaS approval. AI connectors have blown that up. Every employee with a ChatGPT or Claude account can now attach a third-party service that changes its own behavior weekly. Procurement is not even in the room.
2. The “US-only inference” setting is a placebo. Companies pay for US-only inference and think they have solved data sovereignty. The PromptArmor study shows that your data can leave the US the moment a connector forwards it to a subprocessor. The inference location is one node in a chain. The chain is not under your control.
3. The killer use case for AI agents is also the killer flaw. The whole point of agents is to act across systems. That is what makes them valuable. It is also what makes them dangerous. The industry has spent billions making agents more capable and almost nothing making them legible. We are connecting the enterprise nervous system to a black box and hoping for the best.
The Bottom Line
AI connectors are not a future risk. They are a present one, and they are expanding faster than the defenses around them. The PromptArmor study is a warning that the agent ecosystem is becoming a maze of live integrations, each with its own terms, tools, and subprocessors. For attackers, that maze is full of exits. For defenders, it is full of blind corners.
The answer is not to ban agents. It is to admit that the old security model — approve once, trust forever — is dead. The organizations that survive the agent era will be the ones that treat every connector as a living risk, monitor it continuously, and assume that what was safe yesterday may not be safe tomorrow. Because in this market, it probably is not.