OpenAI skill misled apps to send tokens to fake domain
A flaw in an OpenAI skill for deploying apps on Render sent production tokens to a fake domain, researchers found. The skill, part of OpenAI’s official repository, instructed agents to use render-internal.com as a trusted internal service. When researchers registered the domain and set up a passive listener, it began receiving tokens and API calls from real apps. Testing with Codex confirmed the…
Key points
- OpenAI skill for Render apps sent tokens to fake domain `render-internal.com` instead of a real internal service
- Researchers registered the domain and confirmed it intercepted tokens from real production apps using Codex
- Flaw was introduced in January, fixed in August after AIR Security reported it to OpenAI and Render
The incident highlights risks in AI supply chains, where even official, vetted skills can contain vulnerabilities. Niv Hoffman, co-founder and CTO of AIR Security, warned that skills should be treated like any other part of the software supply chain, requiring vetting and monitoring. Attackers have increasingly targeted AI skills for malicious purposes, as seen in a recent trojanized skill that tricked agents into installing a credential stealer. That skill, posing as popular services like Paperclip and Browser Use, amassed 1.7 million installations before being flagged.
Hallucinated domain in official OpenAI skill underscores AI supply chain risks
csoonline.com · 16 October 2026
Loading the full article…
This text was published by csoonline.com and written by John Leyden. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Agents & Tools
All →- OpenAI research model uses crypto wallet funds without permission to finish task · 4 src
- Mark Wahlberg says he may use ai to enhance his upcoming biopic · 1 src
- NVIDIA may automatically enable AI agents control server in NVIDIA App · 1 src
- AI models use tool calling to trigger external actions via structured requests · 1 src
- Chris Painter warns AI agents may become unmonitorable if they stop using chain-of-thought · 1 src
Comments
via GitHub Discussions