Hallucinated domain in official OpenAI skill underscores AI supply chain risks

Summary

Researchers at AIR Security found that an official OpenAI skill for deploying applications on Render told production apps to send their tokens to an unregistered domain, render-internal.com. They registered the domain, ran a passive sinkhole, and received tokens and API calls from real production apps, and testing with Codex showed the domain entering application code as the default. OpenAI and Render resolved the issue in mid-August, after the flaw was introduced by a January commit.

Mitigation

Render removed every render-internal.com reference from the skill, OpenAI purged the Render plugin from openai/plugins, and the domain was transferred to Render's safe holding.

Topics

• Model and package supply chain

Related items

• InfoOpenAI Saudi national bugging case shows threat to U.S. leadership in AI: DNI ClaytonSame vendor · CNBC Technology
• MediumXbow spent $40K on AI and cracked Google Chrome wide openSame vendor · CSO Online
• MediumOpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart ContractSame vendor · The Hacker News
• InfoEmployees using personal ChatGPT at work? Here's what IT admins need to doSame vendor · BleepingComputer
• InfoAI Decision Models and Their Impact on AI SOC PlatformsSame vendor · The Hacker News