{"data":{"id":"90bd9263-2ffe-44cd-b43d-0f8a81bdfe5b","title":"Hallucinated domain in official OpenAI skill underscores AI supply chain risks","summary":"Researchers at AIR Security found that an official OpenAI skill for deploying applications on Render told production apps to send their tokens to an unregistered domain, render-internal.com. They registered the domain, ran a passive sinkhole, and received tokens and API calls from real production apps, and testing with Codex showed the domain entering application code as the default. OpenAI and Render resolved the issue in mid-August, after the flaw was introduced by a January commit.","solution":"Render removed every render-internal.com reference from the skill, OpenAI purged the Render plugin from openai/plugins, and the domain was transferred to Render's safe holding.","labels":["security","industry"],"sourceUrl":"https://www.csoonline.com/article/4236659/hallucinated-domain-in-official-openai-skill-underscores-ai-supply-chain-risks.html","publishedAt":"2026-10-16T17:29:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["supply_chain"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI"],"affectedVendorsRaw":["OpenAI skills repository","Codex","Render","Paperclip","Browser Use","skills.sh"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-16T17:29:00.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"]}}