Understand which tools call external AI
Connectors let Claude take actions in third-party services. As an example, a connector may allow Claude to list emails from Outlook or send an email. However, as more and more apps integrate AI, we've found that third parties developing connectors are now exposing the AI features of their apps as connector tools. The issue is that these AI features may use third-party AI models and subprocessors that may not have been approved by your organization.
We reviewed all 7517 tools from the 487 Claude connectors available at the time of this publication, and assessed the risk of each tool routing requests through a second AI service downstream. Of the 487 connectors, 189, roughly two in five, contained tools that are highly likely to call additional AI services.
Generation is the largest group: more than a quarter of the flagged tools create new content from your input. The rest search, summarize, transcribe, or extract it, and each one routes your data through a model to do it.
- Data residency: the downstream model can run in a region your DPA never approved, and may move without notice.
- Training data and retention: your inputs may be retained, subject to human review, or used to train AI models.
- Nth-party data processing: your data is sent from Claude to the connected app and then to an AI subprocessor such as Azure or even a model provider directly, such as the OpenAI API. Each of these providers may have differing data processing agreements.
- Limited model governance: the model behind a connector's tool can be swapped with no visibility to the connector, impairing an organization's ability to vet whether tools are calling models that have not been approved by one's organization (such as DeepSeek).
As an example, if your Claude agent activates Zoom's connector tool to search meetings with natural language, and passes in a query containing sensitive data, Zoom AI may send that data to any of its twelve AI subprocessors in order to generate a response from one of ten different model families it uses.
Fun fact
In 54 connectors, at least half of their tools were flagged as AI-backed.
Know which connectors call other AI