{"id":10035,"date":"2026-10-16T17:29:00","date_gmt":"2026-10-16T17:29:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10035"},"modified":"2026-10-16T17:29:00","modified_gmt":"2026-10-16T17:29:00","slug":"hallucinated-domain-in-official-openai-skill-underscores-ai-supply-chain-risks","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10035","title":{"rendered":"Hallucinated domain in official OpenAI skill underscores AI supply chain risks"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Researchers have discovered a first-of-its-kind supply-chain vulnerability in OpenAI\u2019s official skills repository.<\/p>\n

OpenAI maintains an official GitHub repository of skills that teach AI agents how to work with various platforms and services. As an official skill, these components are often given an implicit level of trust because they are contributed or vetted by verified vendors.<\/p>\n

Snags arose because one OpenAI skill \u2014 designed to teach agents the best way to deploy applications on Render \u2014 instructed production apps to send their tokens to an unregistered domain (render-internal.com).<\/p>\n

Discovering this flaw, researchers from AIR Security\u2019s Research Lab registered the domain and pointed it at a passive (listening-only) sinkhole, which started receiving tokens and API calls from real production apps.<\/p>\n

Testing the skill with Codex confirmed that the domain made its way into real application code as the default option.<\/p>\n

AIR Security informed OpenAI and Render of the issue, which was resolved in mid-August, allowing its researchers to publish a technical write-up of the flaw<\/a>. The issue was introduced with a commit in January.<\/p>\n

Render removed every render-internal.com reference from the skill while OpenAI purged the Render plugin from openai\/plugins. The domain was also transferred to Render\u2019s safe holding.<\/p>\n

The curated skill contained a hallucinated domain that deployed applications treated as a trusted internal service, putting their secrets within reach of whoever registered it.<\/p>\n

Supply chain risk<\/h2>\n

If researchers hadn\u2019t stumbled across Render skill flaw first, attackers might have abused a domain nobody bothered to buy to run a supply chain attack.<\/p>\n

Niv Hoffman, AIR Security\u2019s co-founder and CTO, said the incident shows that even official, vendor-published AI skills can contain mistakes, unsafe assumptions, dependencies, or vulnerabilities that can lead to exfiltration of secret tokens.<\/p>\n

\u201cSkills should be vetted and monitored like any other part of the software supply chain, so they can be patched or revoked when a vulnerability is found in one of them,\u201d Hoffman said.<\/p>\n

Attackers are increasingly exploring new ways of manipulating AI instruction files<\/a> such as skills toward malicious ends, while also seeking AI credentials to steal or misuse to operationalize their own use of AI<\/a>.<\/p>\n

A recent Trojanized AI skill<\/a> that typosquatted popular AI-related services Paperclip and Browser Use on open agent skills ecosystem skills.sh garnered 1.7M installations in a scheme to instruct agents to install a credential stealer from GitHub instead.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Researchers have discovered a first-of-its-kind supply-chain vulnerability in OpenAI\u2019s official skills repository. OpenAI maintains an official GitHub repository of skills that teach AI agents how to work with various platforms and services. As an official skill, these components are often given an implicit level of trust because they are contributed or vetted by verified vendors. […]<\/p>\n","protected":false},"author":0,"featured_media":10036,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10035","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10035"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10035"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10035\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10036"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}