The report
A deployment assistant can produce risky software without an attacker issuing an explicit malicious prompt. Air Security found an official Render deployment skill that described render-internal.com as a private service domain even though Render did not own the address. In a controlled deployment, a coding agent copied the hostname into its generated service code and configuration. The researchers registered the domain and observed requests from real applications, including Authorization: Bearer headers.
Render removed the incorrect references on August 14; OpenAI removed the bundled plugin on August 26. The October 14 disclosure establishes that the error reached running applications. It does not identify a known criminal campaign, quantify unique victims or prove compromised accounts.
This is a dependency and provenance problem in skills: a trusted author can publish an incorrect remote service address, and an agent can turn that statement into live network behavior. The case record preserves observed sinkhole traffic separately from unconfirmed downstream harms. Updating the original skill cannot retroactively fix configurations deployed using the older guidance.
The correction to the upstream skill cannot undo the hostname already copied into generated applications. Exposure analysis therefore needs both the repository-change date and the inventory of applications deployed with the old default. The reported sinkhole traffic establishes unintended network contact, not the number of exploited accounts.
The correction has two clocks
The August source changes and October publication are different dates. Once generated applications adopted the incorrect hostname, replacing the skill stopped a route for future copying but could not alter code already deployed. A complete exposure review would need to search generated configuration and deployment manifests for the old domain, determine where real requests went, and rotate only credentials shown to have crossed that boundary. The researcher's sinkhole received bearer-bearing traffic, but no verified count of unique affected services is published.
This is an unusually concrete failure of trust in agent-distributed instructions. The agent did not need to violate an explicit order: it implemented apparently official deployment guidance. The needed check was an independently verified service-domain ownership and routing decision before allowing that guidance to become a durable application dependency.