Top agent skill security resources — November 2026

Summary

A roundup of 17 agent skill security resources for November 2026, the first edition of the series, reports that OpenAI's official render-deploy skill directed agents to a private Render service domain that was neither Render's nor registered. Once an attacker registered it as a sinkhole, production apps sent it tokens. The roundup also covers a PyCache substitution that reached 94-100% attack success against seven skill scanners across 100 skills.

Related items

• InfoChatGPT will now make you animated GIFsSame vendor · The Verge (AI)
• MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSame vendor · The Hacker News
• InfoForrester gave Endor Labs the highest score possible in seven criteria, including innovation, AI application flaws, AI SCA, and AI coding toolchain. | Endor LabsSame vendor · Endor Labs Blog
• InfoUber only fulfilled 4 rides from AI agents last quarterSame vendor · The Verge (AI)
• InfoSam Altman addresses RAM comments: People should ‘put as much as they want in their computers’Same vendor · The Verge (AI)