A connector approved for a person is not automatically approved for every agent that person can create.
Zenity Labs published the case for that last week. A single crafted ChatGPT link could drive OpenAI's Agent Builder end to end: one URL parameter selected the most privileged agent template, another supplied instructions the Builder treated as commands rather than as text for the user to confirm. The result was a Workspace Agent the victim never knowingly created — running under their identity, inheriting the connectors they had already authorized (Gmail, Outlook, Slack, SharePoint, Teams), with approvals set to never ask, polling the attacker's inbox every five minutes for new work.
OpenAI fixed it in four days back in June, and there is no evidence it was used in the wild. The architecture lesson outlives the bug.
Creating a persistent agent is closer to issuing a service account than to saving a configuration. I would treat it that way: a new principal needs its own identity, explicit scopes, a named owner, a schedule someone approved, a revocation path, and an audit trail. Existing OAuth consent proves a person once authorized a connector. It does not prove they authorized a new autonomous actor to use it indefinitely.
The dangerous permission is often not the one granted today. It is the trust a new actor silently inherits from yesterday.