Hallucinated domain in official OpenAI skill underscores AI supply chain risks

AIR Security's Research Lab discovered that an official OpenAI skill for deploying applications on Render instructed production apps to send tokens to the unregistered domain render-internal.com, which the researchers registered and pointed at a listening-only sinkhole that then received tokens and API calls from real production apps. OpenAI and Render resolved the issue in mid-August after being notified, with Render removing every render-internal.com reference from the skill and OpenAI purging the Render plugin from openai/plugins, and the domain transferred to Render's safe holding; the flaw was introduced with a commit in January. AIR Security co-founder and CTO Niv Hoffman said the incident shows even official, vendor-published AI skills can contain mistakes, unsafe assumptions, dependencies, or vulnerabilities leading to exfiltration of secret tokens, and that "skills should be vetted and monitored like any other part of the software supply chain.

Researchers have discovered a first-of-its-kind supply-chain vulnerability in OpenAI’s official skills repository. OpenAI maintains an official GitHub repository of skills that teach AI agents how to work with various platforms and services. As an official skill, these components are often given an implicit level of trust because they are contributed or vetted by verified vendors. Snags arose because one OpenAI skill — designed to teach agents the best way to deploy applications on Render — instructed production apps to send their tokens to an unregistered domain render-internal.com . Discovering this flaw, researchers from AIR Security’s Research Lab registered the domain and pointed it at a passive listening-only sinkhole, which started receiving tokens and API calls from real production apps. Testing the skill with Codex confirmed that the domain made its way into real application code as the default option. AIR Security informed OpenAI and Render of the issue, which was resolved in mid-August, allowing its researchers to publish a technical write-up of the flaw https://www.air.security/blog-posts/render-openai . The issue was introduced with a commit in January. Render removed every render-internal.com reference from the skill while OpenAI purged the Render plugin from openai/plugins. The domain was also transferred to Render’s safe holding. The curated skill contained a hallucinated domain that deployed applications treated as a trusted internal service, putting their secrets within reach of whoever registered it. If researchers hadn’t stumbled across Render skill flaw first, attackers might have abused a domain nobody bothered to buy to run a supply chain attack. Niv Hoffman, AIR Security’s co-founder and CTO, said the incident shows that even official, vendor-published AI skills can contain mistakes, unsafe assumptions, dependencies, or vulnerabilities that can lead to exfiltration of secret tokens. “Skills should be vetted and monitored like any other part of the software supply chain, so they can be patched or revoked when a vulnerability is found in one of them,” Hoffman said. Attackers are increasingly exploring new ways of manipulating AI instruction files https://www.csoonline.com/article/4204731/attackers-are-crafting-malicious-ai-instruction-files-to-turn-your-agentic-workflows-into-quiet-criminal-helpers.html such as skills toward malicious ends, while also seeking AI credentials to steal or misuse to operationalize their own use of AI https://www.csoonline.com/article/4221307/threat-actors-are-coming-for-your-ai-assets-to-operationalize-their-use-of-ai.html . A recent Trojanized AI skill https://www.csoonline.com/article/4206851/trojanized-ai-skills-gain-1-7m-installs-in-agent-targeted-attack.html that typosquatted popular AI-related services Paperclip and Browser Use on open agent skills ecosystem skills.sh garnered 1.7M installations in a scheme to instruct agents to install a credential stealer from GitHub instead.