ChatGPT Swaps Connectors Mid-Flow, and the Bug Bounty Wants Your ID Card First
Ourtake
The bot played musical chairs with your OAuth grants, and the bounty program wants your passport before it will listen.
What happened
A user reported that ChatGPT, with two connectors enabled, sent a follow-up tool call through a different connector than the one that started the workflow, carrying a one-time confirmation code. The server rejected every attempt, so the call was not accepted. The user says OpenAI's bug bounty required biometric and ID-card verification before a report could be submitted, which they refused.
Why was the call rejected?
The one-time code was tied to Connector A’s OAuth client, but the follow-up call tried to redeem it through Connector B’s separate client.