{"schema":"postcutoff/event@1","as_of":"2026-10-17T02:25:00+02:00","url":"https://postcutoff.com/e/2026-10-14-openai-render-skill-hallucinated-domain/","md":"https://postcutoff.com/e/2026-10-14-openai-render-skill-hallucinated-domain/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-14-openai-render-skill-hallucinated-domain","date":"2026-10-14","date_precision":"day","short_title":"AIR Security: OpenAI's official render-deploy agent skill pointed apps at an unregistered, apparently hallucinated domain; a sinkhole on it received live tokens from production apps","deck":null,"takeaway":"AIR Security disclosed on Oct 14, 2026 that OpenAI's official \"render-deploy\" skill (openai skills repo, bundled in openai/plugins) told agents to configure deployed apps with endpoints on render-internal.com, a domain nobody owned.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":[{"n":1,"title":"AIR Security: OpenAI Sesame, skill vulnerability in OpenAI's official skill (Oct 14)","url":"https://www.air.security/blog-posts/render-openai","type":"official","group":"primary","domain":"air.security"},{"n":2,"title":"CSO Online: Hallucinated domain in official OpenAI skill underscores AI supply chain risks (Oct 16)","url":"https://www.csoonline.com/article/4236659/hallucinated-domain-in-official-openai-skill-underscores-ai-supply-chain-risks.html","type":"press","group":"press","domain":"csoonline.com"}],"official":1,"filed":"2026-10-17","updated":"2026-10-17","orgs":["OpenAI","Render","AIR Security"],"title":"AIR Security: OpenAI's official render-deploy agent skill pointed apps at an unregistered, apparently hallucinated domain; a sinkhole on it received live tokens from production apps","summary":"AIR Security disclosed on Oct 14, 2026 that OpenAI's official \"render-deploy\" skill (openai skills repo, bundled in openai/plugins) told agents to configure deployed apps with endpoints on render-internal.com, a domain nobody owned. After the researchers registered it as a passive sinkhole, it received token-bearing calls from real production apps. Render removed the references on Aug 14 and OpenAI pulled the plugin on Aug 26, 2026; the domain is now held by Render.","key_facts":["Write-up: 'OpenAI Sesame: Skill Vulnerability in OpenAI's Official Skill Made Production Apps Leak Tokens, Real Victims Found in the Wild', Eliad Mualem and Dor Granat, AIR Security, Oct 14, 2026","Flawed guidance in references/service-types.md (a similar database URL in references/configuration-guide.md) of the render-deploy skill; render-internal.com is not a Render domain","Timeline from commits: added in the skill's initial commit Jan 27, 2026; bundled in openai/plugins Mar 13; Render removed the references Aug 14; OpenAI removed the Render plugin Aug 26; domain transferred to Render","Testing with Codex showed the domain being inserted into real application code as the default; the sinkhole received live token-bearing API calls (no count published)","CSO Online (John Leyden, Oct 16) frames it as an AI supply-chain risk; AIR Security CTO Niv Hoffman: skills should be 'vetted and monitored like any other part of the software supply chain'","CSO Online calls the domain 'hallucinated', i.e. apparently invented by a model while the skill was written; neither OpenAI nor AIR Security states how it got there in what we read"],"key_numbers":[],"tags":["security","supply-chain","agent-skills","hallucination","codex","tokens","incident"],"science":null,"body_md":"## What happened\n\nOpenAI publishes official \"skills\", instruction bundles that teach agents such as Codex how to do specific jobs. Its skill\nfor deploying apps on Render contained a made-up internal hostname, render-internal.com, that no one had registered. Agents\nfollowing the skill wrote that hostname into application configs, so deployed apps sent authentication tokens to it.\nAIR Security registered the domain, pointed it at a listening-only sinkhole and saw real traffic from production apps. It\nthen coordinated fixes with Render and OpenAI before publishing.\n\n## Why it matters\n\nWhoever had registered the domain first could have collected live credentials from every app built with the skill. A\nmistake that CSO Online calls a hallucination sat for more than six months in a skill published by OpenAI itself. Agent skills and\nplugins are a new software supply chain, and a vendor's name on them is no guarantee they were reviewed.","disputed":[],"related":[],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-17","type":"filed","text":"Created. AIR Security and CSO Online read"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-17","run":null,"sources_read":"AIR Security and CSO Online read","updated":"2026-10-17","human_review":null,"version":null},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":167,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":106,"in_training_data":false},{"model_id":"gemini-4-argon","name":"Gemini 4 Argon","cutoff":"2026-03","days_after":197,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":136,"in_training_data":false}],"short_url":null}