Integrating AI agents with third-party services like Gmail, Slack, and Zoom dramatically expands the security attack surface, according to new research from security firm PromptArmor, which found that connectors, the integration bridges between AI platforms and external tools, are changing so rapidly that static security approvals have become dangerously obsolete.
PromptArmor analyzed 2,517 connectors across the AI agent ecosystem over a six-week period from mid-May to the end of June. The firm found that 931 of those connectors, 37 percent, changed during the window. Connectors accumulated 1,686 new tools and had 1,127 tool descriptions rewritten. “Any security assumptions based on declared capabilities may no longer be valid,” the researchers wrote.
The Dropbox connector was a stark example. At the start of the study it exposed eight tools. By the end it exposed 24. Write-capable tools grew from three to ten, and potentially destructive tools grew from zero to four. Permission scopes shifted, and model instructions were injected into the connector’s configuration without notice.
An even more concerning finding: roughly two in five connectors (189 of 487 Claude connectors analyzed) call additional third-party AI services beyond the primary integration partner. The Zoom connector illustrates the problem clearly. When a Claude agent activates Zoom’s connector to search meetings using natural language and passes a query containing sensitive data, that data may be forwarded to any of Zoom’s ten AI subprocessors, which in turn may use one of eight different model families to generate a response.
Anthropic’s own documentation acknowledges the limitation. “Connected services process data on their own infrastructure, under their own terms, which may be located outside the United States,” the company states. “Settings that control where Claude’s inference runs, like the US-only inference setting on Enterprise plans, don’t change where third-party services operate.”
PromptArmor co-founder Shankar Krishnan described the combination of three conditions, access to private data, exposure to untrusted content, and an external communication path, as a “lethal trifecta.” When these conditions converge, “the blast radius of an attack explodes,” he said.
The research carries immediate practical implications for security teams. Connector capabilities must be monitored continuously rather than approved once. Each connector’s tool inventory, especially write and destructive tool counts, needs regular auditing. And organizations cannot assume that an AI vendor’s security controls extend to the third-party services their connectors invoke.
“Most teams approving connectors are evaluating and considering the connector, unaware that the vendor is calling more AI services, adding new subprocessors and terms,” Krishnan said.
Sources: Connecting AI agents to outside services explodes the risk radius (The Register, July 2026)