AIR Security: OpenAI’s official render-deploy agent skill pointed apps at an unregistered, apparently hallucinated domain; a sinkhole on it received live tokens from production apps
Confirmed
The takeaway
AIR Security disclosed on Oct 14, 2026 that OpenAI’s official “render-deploy” skill (openai skills repo, bundled in openai/plugins) told agents to configure deployed apps with endpoints on render-internal.com, a domain nobody owned.
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 3 of 5
- Last verified
- 17 October 2026
Your AI and this story
- GPT-6 Astra167 days after its cutoff
- Claude Opus 5.5106 days after its cutoff
- Gemini 4 Argon197 days after its cutoff
- Grok 4.7136 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 106 days before it.
Key facts
- Write-up: ‘OpenAI Sesame: Skill Vulnerability in OpenAI’s Official Skill Made Production Apps Leak Tokens, Real Victims Found in the Wild’, Eliad Mualem and Dor Granat, AIR Security, Oct 14, 2026
- Flawed guidance in references/service-types.md (a similar database URL in references/configuration-guide.md) of the render-deploy skill; render-internal.com is not a Render domain
- Timeline from commits: added in the skill’s initial commit Jan 27, 2026; bundled in openai/plugins Mar 13; Render removed the references Aug 14; OpenAI removed the Render plugin Aug 26; domain transferred to Render
- Testing with Codex showed the domain being inserted into real application code as the default; the sinkhole received live token-bearing API calls (no count published)
- CSO Online (John Leyden, Oct 16) frames it as an AI supply-chain risk; AIR Security CTO Niv Hoffman: skills should be ‘vetted and monitored like any other part of the software supply chain’
- CSO Online calls the domain ‘hallucinated’, i.e. apparently invented by a model while the skill was written; neither OpenAI nor AIR Security states how it got there in what we read
What happened
OpenAI publishes official “skills”, instruction bundles that teach agents such as Codex how to do specific jobs. Its skill for deploying apps on Render contained a made-up internal hostname, render-internal.com, that no one had registered. Agents following the skill wrote that hostname into application configs, so deployed apps sent authentication tokens to it. AIR Security registered the domain, pointed it at a listening-only sinkhole and saw real traffic from production apps. It then coordinated fixes with Render and OpenAI before publishing.
Why it matters
Whoever had registered the domain first could have collected live credentials from every app built with the skill. A mistake that CSO Online calls a hallucination sat for more than six months in a skill published by OpenAI itself. Agent skills and plugins are a new software supply chain, and a vendor’s name on them is no guarantee they were reviewed.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 1 primary, 1 press
Primary
- AIR Security: OpenAI Sesame, skill vulnerability in OpenAI’s official skill (Oct 14)air.security, official
Press
Changes
- Filed. AIR Security and CSO Online read