An instruction file in OpenAI's official collection of skills for AI coding agents told them to send internal traffic to a web domain no one had registered, and production apps built with it later sent live access tokens to that address, according to research by security firm AIR Security reported Friday by CSO Online. The case shows that even vendor-published guidance for AI agents can quietly route a company's secrets to outsiders, putting these files squarely inside the software supply chain that security teams must vet.
What Happened
AI coding agents such as OpenAI's Codex can load "skills," bundles of written instructions that teach the agent how to work with a particular platform or service. OpenAI maintains an official collection of them on GitHub. One, called render-deploy, explains how to deploy applications on Render, a cloud hosting service.
According to AIR Security's Oct. 14 write-up, "OpenAI Sesame: Skill Vulnerability in OpenAI's Official Skill Made Production Apps Leak Tokens, Real Victims Found in the Wild," the skill described render-internal.com as if it were Render's private networking domain. It is not: the address appears nowhere in Render's documentation, and Render's private networking does not use it. The guidance was present from the skill's first commit Jan. 27, 2026, and the skill was bundled into OpenAI's openai/plugins repository March 13.
When the researchers asked Codex to deploy two services that talk to each other using the skill, the agent wrote the domain into the generated application code as the default internal address and into the deployment settings. Unless a developer replaced it, apps would use that default.
AIR then registered the domain itself and pointed it at a passive, listen-only server, known as a sinkhole, that records incoming traffic. Real production applications began connecting, sending what the researchers describe as live, token-bearing calls to what the apps believed were their own internal services. Neither AIR nor CSO published how many apps or requests were involved, which tokens were exposed, or how the captured traffic was handled.
AIR said it disclosed the problem to OpenAI and Render. Render removed every reference to the domain Aug. 14, and OpenAI removed the Render plugin from openai/plugins Aug. 26. The domain was then transferred to Render for safekeeping. CSO's report includes no comment from either company.
Why It Matters
These findings are vendor research from AIR Security, a security company, and CSO's report relies on its account. Still, the failure pattern is concrete. CSO noted that an attacker who registered the domain before AIR could have used it for a supply-chain attack, and that the skill's official origin gave it implicit trust. CSO called the address a "hallucinated" domain, the term for details an AI system makes up, though neither CSO nor AIR says how it entered the skill.
For executives, the lesson is that AI agent instructions are now code dependencies. A single wrong line in a trusted file was copied into real configurations, and the apps leaked credentials without any malware involved. Niv Hoffman, AIR's co-founder and chief technology officer, told CSO that skills should be vetted and monitored "like any other part of the software supply chain."
The risk is not limited to mistakes. CSO also pointed to a separate case on the skills.sh marketplace, where a malicious skill imitating the names of popular tools reportedly gathered 1.7 million installations and told agents to install software that steals credentials.
What to Watch
Open questions include how many deployed apps still carry the bad address in their settings, whether any tokens sent to it should be rotated, and whether OpenAI and other publishers add automated checks on the domains and dependencies their skills reference. AIR recommends that organizations treat every domain, repository and API a skill names as a dependency to validate and monitor, and update to the patched skill.
