The risk was not a malicious-looking instruction or code hidden by a third party. A legitimate skill supplied a plausible private-networking hostname, and an agent embedded it into defaults used by newly generated software. When that name resolved publicly under the researchers’ registration, programs outside the original agent session sent authenticated…
Inspect the ClaimsCase · DiggingBeagle record
An official deployment skill introduced an unowned host into production application configurations
Researchers found a Render deployment skill in an OpenAI-managed repository directing coding agents toward render-internal.com, which Render did not own. A controlled agent copied the host into generated code and actual deployed services later sent token-bearing requests to the researchers’ registered domain.
Scope
An officially distributed deployment instruction became a production dependency. Validity of confidential data is based on observed Authorization headers, not independent access to the affected application accounts.
Assessment profile
Assessment method- Setting
- controlled live
- Exploitation
- observed live
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
The investigators controlled the abandoned hostname and observed real unintended application requests in their sinkhole. Source remediation was reported, but persistence of previously generated deployments remains unknown. Assessment uses the pinned Claims and source identities; public primary pages were not independently retrievable during this run. Impact remains unrated because field consequence or a comparable scoring rubric is not established.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP7-SESAME-FIX · CLM-CP7-SESAME-LIVE · CLM-CP7-SESAME-TRANSFER · CLM-CP7-SESAME-WRONG-DNS · Air Security: OpenAI Sesame Render skill dependency failure
At a glance
Number of affected services or unique bearer credentials is not disclosed. No independently attributed attacker campaign or confirmed downstream account takeover. Prior application deployments may retain old generated hostnames even after the source skill was fixed.
Limits and uncertaintyFull account
The risk was not a malicious-looking instruction or code hidden by a third party. A legitimate skill supplied a plausible private-networking hostname, and an agent embedded it into defaults used by newly generated software. When that name resolved publicly under the researchers’ registration, programs outside the original agent session sent authenticated requests there. The source identifies original and remediation commits; the exact exposed credentials are not reproduced. This is evidence of real unintended egress in the investigator-controlled sinkhole and does not establish subsequent hostile reuse by a separate attacker.
The hostname moved from trusted skill text into deployed application configuration. Correcting the source skill stops future copying of the bad default, but does not repair applications already generated from it; those require an inventory of resulting deployed hostnames.
Claims & evidence
CLM-CP7-SESAME-FIXRender removed references to the mistaken domain on August 14 and OpenAI removed the affected bundled Render plugin on August 26, according to repository changes cited by the researchers.supported
Basis: reported finding
- supportsAir Security: OpenAI Sesame Render skill dependency failureprimary disclosure
Render & OpenAI responses; identified August commits
CLM-CP7-SESAME-LIVEAfter registering the domain for a passive sinkhole, the investigators observed live application requests containing Authorization: Bearer headers.supported
Basis: reported finding
- supportsAir Security: OpenAI Sesame Render skill dependency failureprimary disclosure
Theory to Reality; sinkhole received HEAD and GET with authorization header
CLM-CP7-SESAME-TRANSFERUsing the official skill for a normal deployment request, researchers observed Codex copying the unowned host into generated Go service defaults and deployment configuration.supported
Basis: reported finding
- supportsAir Security: OpenAI Sesame Render skill dependency failureprimary disclosure
Theory to Reality; generated application code and generated configuration
CLM-CP7-SESAME-WRONG-DNSThe reference files in the render-deploy skill described render-internal.com as Render private networking, although the real provider had no ownership or documented dependency on that domain.supported
Basis: reported finding
- supportsAir Security: OpenAI Sesame Render skill dependency failureprimary disclosure
The Dependency of My Dependency Is My Vulnerability; quoted references/service-types.md and configuration-guide.md
Unknowns and contradictions
- Number of affected services or unique bearer credentials is not disclosed.
- No independently attributed attacker campaign or confirmed downstream account takeover.
- Prior application deployments may retain old generated hostnames even after the source skill was fixed.
Sources and citation
Material revision history
- Oct 15, 2026 · Canonical change recorded · new in release · revision 150