OpenAI agent skill exposes Render tokens via unregistered domain
Is this a scandal?
Not yet — an early signal. Noise 33/100, cooling down, across 2 sources.
OpenAI will likely implement automated verification pipelines for infrastructure-related skills because manual curation cannot keep pace with vendor configuration changes.
Noise 33/100 — louder than 95% of tracked AI controversies.
Why it matters
Demonstrates that LLM hallucinations in agentic workflows can create active supply chain vulnerabilities, not just passive misinformation risks.
Key points
- AIR Security intercepted production tokens by registering a domain hallucinated by an official OpenAI skill.
- The OpenAI skill incorrectly identified render-internal.com as Render's private network endpoint.
- Render patched its documentation, but OpenAI's skill definition reportedly still contains the malicious URL.
- Live production applications were confirmed sending authentication credentials to the attacker-controlled domain.
- Incident demonstrates how static LLM knowledge bases create persistent supply chain risks in agentic AI.
The story
Security researchers at AIR Security reported that an official OpenAI skill instructed AI agents to send authentication tokens to an unregistered domain falsely identified as Render’s private network. The researchers registered the hallucinated domain, render-internal.com, and successfully intercepted tokens from live production applications before Render updated its documentation. Although Render has corrected its internal references, OpenAI’s skill definition allegedly continues to contain the fraudulent endpoint as of October 17, 2026. This incident highlights a critical vulnerability in autonomous AI systems where model hallucinations regarding infrastructure configurations can be exploited for credential theft. The exposure persists because the AI tool’s knowledge base was not synchronized with the vendor’s security patch. Neither OpenAI nor Render has publicly commented on the specific timeline for remediation or the scope of compromised credentials.
Who's involved
Reported the vulnerability and demonstrated active token interception to prove the exploitability of OpenAI's hallucinated domain.
Maintains the official skill containing the unregistered domain despite Render's documentation fix, according to AIR Security.
Corrected its own documentation to remove the fake domain reference but cannot control OpenAI's cached skill data.
How the conversation shifted
Polarity (0–100) from the noise pipeline, sampled over time.
Noise Level
The timeline
Render patches documentation
Render removed references to the unregistered domain from its official materials after the vulnerability was identified.
OpenAI skill remains unpatched
AIR Security reports the official OpenAI skill still directs agents to the attacker-controlled domain despite Render's fix.
AIR Security discloses OpenAI skill vulnerability
Researchers revealed they registered render-internal.com and captured production tokens from agents following OpenAI's hallucinated instructions.
The full record
Sources & methodology
- twitter.com — twitter.com
Every claim above traces to these primary items. How we score →
The forecast
OpenAI will likely implement automated verification pipelines for infrastructure-related skills because manual curation cannot keep pace with vendor configuration changes.
Forecast, not fact — an editorial estimate we score when this resolves.
That's the complete picture as of — nothing more to know right now. We'll update this page the moment it changes.
Follow this story
We keep this page current — no need to check back. We'll send the next real change to your inbox, nothing else.
Tracking this story since October 17, 2026.
Join the Discussion
Discuss this story
Community comments coming in a future update
Be the first to share your perspective. Subscribe to comment.