{"version":1,"type":"story","url":"https://digestai.news/story/openai-skill-misled-apps-to-send-tokens-to-fake-domain","json":"https://digestai.news/story/openai-skill-misled-apps-to-send-tokens-to-fake-domain.json","markdown":"https://digestai.news/story/openai-skill-misled-apps-to-send-tokens-to-fake-domain.md","slug":"openai-skill-misled-apps-to-send-tokens-to-fake-domain","headline":"OpenAI skill misled apps to send tokens to fake domain","summary":"A flaw in an OpenAI skill for deploying apps on Render sent production tokens to a fake domain, researchers found. The skill, part of OpenAI’s official repository, instructed agents to use `render-internal.com` as a trusted internal service. When researchers registered the domain and set up a passive listener, it began receiving tokens and API calls from real apps. Testing with Codex confirmed the domain appeared in generated code as the default option. The issue was introduced in January and fixed in August after AIR Security reported it to OpenAI and Render. Render removed all references to the domain, and OpenAI removed the Render plugin from its repository. The domain was transferred to Render’s safe holding.\n\nThe incident highlights risks in AI supply chains, where even official, vetted skills can contain vulnerabilities. Niv Hoffman, co-founder and CTO of AIR Security, warned that skills should be treated like any other part of the software supply chain, requiring vetting and monitoring. Attackers have increasingly targeted AI skills for malicious purposes, as seen in a recent trojanized skill that tricked agents into installing a credential stealer. That skill, posing as popular services like Paperclip and Browser Use, amassed 1.7 million installations before being flagged.","keyPoints":["OpenAI skill for Render apps sent tokens to fake domain `render-internal.com` instead of a real internal service","Researchers registered the domain and confirmed it intercepted tokens from real production apps using Codex","Flaw was introduced in January, fixed in August after AIR Security reported it to OpenAI and Render"],"whyItMatters":"The flaw demonstrates how AI skills—even from trusted vendors—can introduce supply chain risks, exposing secrets to attackers. It underscores the need for stricter vetting and monitoring of AI components in production environments.","category":{"slug":"agents","name":"Agents & Tools","url":"https://digestai.news/category/agents"},"entities":{"companies":["OpenAI","Render","AIR Security"],"models":["Codex"],"people":["Niv Hoffman"]},"firstPublishedAt":"2026-10-16T03:19:00Z","updatedAt":"2026-10-16T03:19:00Z","sourceCount":1,"hasPrimarySource":false,"sources":[{"outlet":"csoonline.com","title":"Hallucinated domain in official OpenAI skill underscores AI supply chain risks","url":"https://csoonline.com/article/4236659/hallucinated-domain-in-official-openai-skill-underscores-ai-supply-chain-risks.html","publishedAt":"2026-10-16T03:19:00Z","type":"press","primary":false,"lead":true}],"sourceNotes":null,"discussions":[],"thread":null,"cite":{"text":"Digest AI, \"OpenAI skill misled apps to send tokens to fake domain\", 16 October 2026, https://digestai.news/story/openai-skill-misled-apps-to-send-tokens-to-fake-domain","publisher":"Digest AI","title":"OpenAI skill misled apps to send tokens to fake domain","datePublished":"2026-10-16T03:19:00Z","url":"https://digestai.news/story/openai-skill-misled-apps-to-send-tokens-to-fake-domain"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}