OpenAI Render Skill Flaw: API Token Risks

🔐 OpenAI's Render Skill Vulnerability: How an AI Agent Could Send API Tokens to an Untrusted Domain
An official OpenAI AI skill contained incorrect networking instructions that caused coding agents to use a domain that Render did not own. The problem was serious: applications generated with that skill could send real API requests and authentication tokens to an external server controlled by whoever registered the domain.
The vulnerability, discovered by security researchers at AIR Security, shows why you should never blindly trust an AI skill just because it comes from an official repository.
Here's what happened and how to protect your applications.

---

🧩 What Is an AI Skill?​

An AI skill is a set of instructions that teaches an AI agent how to perform a specific task.
For example, a skill can teach an agent how to:

• Deploy applications to Render.
• Configure databases and APIs.
• Work with specific frameworks.
• Automate development tasks.

Coding agents such as OpenAI Codex, Claude Code, and Cursor can use these instructions to generate code and configure applications.
But there's an important security concern: an AI agent can turn incorrect instructions inside a skill into real application code.

---

🚨 What Happened to OpenAI's render-deploy Skill?​

The vulnerable skill was called render-deploy. It provided instructions for deploying applications and connecting internal services on Render.
One of its reference files incorrectly claimed that Render's internal services used this domain format:

[service-name].render-internal.com

The problem?
Render did not own this domain, and it was not part of its documented internal networking system.
The domain was also available for registration, meaning an attacker could potentially register it and control the traffic sent to it.

---

⚙️ How Did the Vulnerability Work?​

AIR Security researchers tested the skill using OpenAI Codex.
They asked Codex to deploy two services that needed to communicate with each other internally on Render.
Codex followed the skill's instructions and inserted the incorrect domain into two places:

1. Application code: The domain became the default URL used to communicate with the internal service.
2. Deployment configuration: The same URL was added to the application's environment configuration.

This meant that if no alternative URL was provided at runtime, the application would automatically connect to the incorrect domain.
The researchers then registered render-internal.com and pointed it to a passive server known as a sinkhole, which records incoming network requests.
The result was alarming: real applications started sending API requests containing authentication tokens to the researchers' server.
These applications believed they were communicating with their own internal services.

---

🎯 What Could an Attacker Have Done?​

If a malicious attacker had registered the domain before the researchers, they could potentially have received sensitive information from applications using the incorrect configuration.
Depending on the requests and exposed credentials, this could include:

• API authentication tokens.
• Bearer tokens in HTTP Authorization headers.
• Sensitive service-to-service requests.
• Other information included in application requests.

Important: AIR Security demonstrated that real applications sent token-bearing requests to its sinkhole. The report did not establish that a malicious attacker had stolen those tokens, nor did it publish the number of affected applications.

---

📅 When Was the Vulnerability Fixed?​

According to AIR Security's disclosure, the timeline was:

Date	Event
January 27, 2026	Incorrect domain instructions were introduced into the skill.
March 13, 2026	The skill was included in OpenAI's plugin repository.
August 14, 2026	Render removed the incorrect domain references from its skill.
August 26, 2026	OpenAI removed the Render plugin from its plugins repository.
October 14, 2026	AIR Security published its research.

The domain was subsequently transferred to Render's control to prevent unauthorized registration and abuse.

Important security note
Removing the plugin does not necessarily mean every copy of the skill has been corrected.
As of November 15, 2026, the curated render-deploy files in OpenAI's separate openai/skills repository still contain references to render-internal.com.
You should inspect the exact version of the skill you use rather than assuming that every official copy is patched.

---

🛡️ How to Protect Yourself When Using AI Skills​

Treat AI skills like third-party software dependencies. Review them before installation and check the code generated by your agent.
Here are four practical security checks:

1. Read the skill files
Don't install a skill just because it has an official badge or comes from a trusted repository.
Review its instructions and reference files before allowing your agent to use them.

2. Check external domains and URLs
Look for domains, API endpoints, external repositories, and links referenced inside the skill.
You can use this Bash command to search for common domain references:

grep -RniE 'https?://|[A-Za-z0-9.-]+.(com|io|net|dev)' ./path-to-skill/

Verify that every important external domain actually belongs to the expected service.

3. Review AI-generated configuration
Pay special attention to:

• Default API URLs.
• Environment variables.
• Database connection strings.
• Internal service endpoints.
• Authentication headers.

Never assume a URL generated by an AI agent is legitimate without checking it.

4. Avoid unsafe fallback URLs
If an application requires an internal API URL, make it fail when the environment variable is missing instead of silently connecting to an unexpected default.
For example, in Node.js:

const API_URL = process.env.INTERNAL_API_URL;
if (!API_URL)

This prevents an application from silently using an unverified endpoint.

---

🔍 Already Used the Vulnerable Render Skill? Do This​

If you deployed applications using an affected version of render-deploy, don't assume removing the skill is enough.

1. Search your application code and deployment configuration for render-internal.com.
2. Check environment variables and currently deployed service configurations.
3. Replace incorrect endpoints with verified Render internal addresses.
4. If your applications sent credentials to the affected domain, rotate the potentially exposed API tokens and secrets.
5. Review application logs for unexpected outbound requests.

Don't forget: Fixing the skill does not automatically fix applications that were already generated and deployed.

---

💡 The Biggest Lesson: Official Doesn't Always Mean Safe​

This incident highlights an important security issue with AI coding agents.
A skill is not just a harmless text file. Its instructions can influence generated code, deployment settings, API connections, and application behavior.
That's why I consider AI skills another part of the software supply chain, just like packages and external dependencies.
Before installing your next skill, ask yourself:

• Did I actually read its instructions?
• Did I verify the domains and external URLs it references?
• Can the agent introduce unsafe default values into my code?
• Did I review the generated code before deploying it?

Remember: Trust the source, but verify the instructions. 🔐

---

Frequently Asked Questions​

------------------

Can an official OpenAI skill contain security vulnerabilities?​

Yes. An official skill can contain incorrect instructions, unsafe defaults, or vulnerable external dependencies.

Which AI coding agents could be affected?​

The reported vulnerability was reproduced using OpenAI Codex. Other coding agents may also be exposed if they use the same vulnerable skill instructions.

Were real API tokens exposed?​

AIR Security reported receiving real token-bearing requests from production applications through its sinkhole. The researchers did not publish the number of affected applications.

Should I rotate my API tokens?​

If your deployed application used the incorrect domain and sent requests containing credentials to it, rotate potentially exposed tokens and secrets immediately.