Hallucinated domain in official OpenAI skill underscores AI supply chain risks
An official OpenAI skill pointed apps at an unregistered domain that collected real production tokens.
AIR Security found that an official OpenAI skill for deploying applications on Render instructed agents to send tokens to render-internal.com, a domain that had not been registered. Researchers registered and sinkholed it, then received tokens and API calls from real production apps; testing with Codex showed the domain was inserted into application code as the default. The reference was introduced in a January commit and removed in mid-August after disclosure, with Render deleting it from the skill, OpenAI purging the plugin, and the domain transferred to Render. The report also describes a separate typosquatted skill on skills.sh that drew about 1.7 million installations and instructed agents to install a credential stealer from GitHub.
- An official OpenAI Render skill sent tokens to unregistered domain render-internal.com.
- AIR Security registered the domain and received tokens from real production apps.
- OpenAI and Render removed the references in mid-August and transferred the domain.
- A separate typosquatted skill reached about 1.7 million installs to deliver a stealer.
Full article390 words · extracted from csoonline.com · click to collapse
Researchers have discovered a first-of-its-kind supply-chain vulnerability in OpenAI’s official skills repository.
OpenAI maintains an official GitHub repository of skills that teach AI agents how to work with various platforms and services. As an official skill, these components are often given an implicit level of trust because they are contributed or vetted by verified vendors.
Snags arose because one OpenAI skill — designed to teach agents the best way to deploy applications on Render — instructed production apps to send their tokens to an unregistered domain (render-internal.com).
Discovering this flaw, researchers from AIR Security’s Research Lab registered the domain and pointed it at a passive (listening-only) sinkhole, which started receiving tokens and API calls from real production apps.
Testing the skill with Codex confirmed that the domain made its way into real application code as the default option.
AIR Security informed OpenAI and Render of the issue, which was resolved in mid-August, allowing its researchers to publish a technical write-up of the flaw. The issue was introduced with a commit in January.
Render removed every render-internal.com reference from the skill while OpenAI purged the Render plugin from openai/plugins. The domain was also transferred to Render’s safe holding.
The curated skill contained a hallucinated domain that deployed applications treated as a trusted internal service, putting their secrets within reach of whoever registered it.
Supply chain risk
If researchers hadn’t stumbled across Render skill flaw first, attackers might have abused a domain nobody bothered to buy to run a supply chain attack.
Niv Hoffman, AIR Security’s co-founder and CTO, said the incident shows that even official, vendor-published AI skills can contain mistakes, unsafe assumptions, dependencies, or vulnerabilities that can lead to exfiltration of secret tokens.
“Skills should be vetted and monitored like any other part of the software supply chain, so they can be patched or revoked when a vulnerability is found in one of them,” Hoffman said.
Attackers are increasingly exploring new ways of manipulating AI instruction files such as skills toward malicious ends, while also seeking AI credentials to steal or misuse to operationalize their own use of AI.
A recent Trojanized AI skill that typosquatted popular AI-related services Paperclip and Browser Use on open agent skills ecosystem skills.sh garnered 1.7M installations in a scheme to instruct agents to install a credential stealer from GitHub instead.