PromptArmor spent six weeks, mid-May to the end of June, watching what happens to AI connectors companies had already approved for Claude and ChatGPT. The vendors kept shipping updates. Across 2,517 connectors, 931 changed in some way that mattered: a new tool, a wider permission scope, a rewritten description telling the model when to act. On average, a connector changed every nine minutes. Dropbox's connector went from 8 tools to 24, from 3 that could write to 10, and picked up 4 tools flagged as destructive and 8 new permission scopes along the way. Slack went from 14 tools to 32, and from a single permission scope to 34.
None of the connector changes came with prompts asking anyone to approve the new versions.
Every tool call in your AI platform should answer to a registry the agent doesn't control and the vendor doesn't own. One that only grants what was actually signed off for that specific action, not whatever a vendor connector happens to expose today. Connector and tool security shouldn't come down to a compliance team reading changelogs across hundreds of vendors, hoping to catch a new delete permission before an agent uses it.
Watching harder and monitoring isn't going to fix the problem. It's an authorization and control issue. A company that approved a connector in May authorized a specific, bounded set of tools and permissions, not a standing subscription to whatever that vendor decides to ship in June. Once approved, though, that's exactly what it became: 1,686 new tools landed on connectors that were already live, 86 new OAuth scopes got requested, and 21 connectors that were purely read-only quietly picked up the ability to create, edit, or delete data. The thing you approved became something else.
This isn't dissimilar to Hugging Face's breach and the NadMesh botnet sweep this month. Access outlived the moment and no one actually checked it. Those were credentials nobody revoked. This is scope nobody (re)approved.
That's what NuDay's signed tool registry does: every tool call an agent makes is checked against a current, cryptographically signed definition of what that agent is authorized to run, so a connector that quietly grew a delete button doesn't hand your agent a delete button too. New capability has to be signed in before an agent can touch it, not inherited because a vendor pushed an update. See how it works or request a demo.
Sources: PromptArmor, "Claude and ChatGPT Connectors Change Every 9 Minutes" · The Next Web, "Four teams just broke AI agents four ways in ten days. The flaw is the same one."