AI Governance Institute
← News
Research2026-10-16

Hallucinated OpenAI Skill Domain Captured Real Authentication Tokens From Live Apps

What happened

Security researchers at AIR Security disclosed that an official OpenAI skill designed for use with the Render cloud platform contained a domain name that did not exist. The AI had invented the domain during the skill's creation. The finding is documented in the Hallucinated domain in official OpenAI skill underscores AI supply chain risks report published October 16, 2026. The fabricated address was not a typo or a draft artifact. It appeared in code that told production applications to send authentication tokens to that address. Authentication tokens are the digital keys applications use to prove their identity and access protected systems. The researchers registered the domain themselves and received real tokens from real applications that had already deployed the skill. The incident follows a broader pattern of AI supply chain vulnerabilities, including 68 MCP Server CVEs in One Month and the Plugin4Shell flaw that broke approved-plugin controls. It illustrates that AI-generated components can carry plausible-looking but dangerous errors even when they pass vendor review.

Why it matters

  • ·Vendor-vetted does not mean safe. An official skill cleared by a major AI platform still contained a credential-stealing flaw. Organizations cannot rely on marketplace approval as a substitute for their own testing before deployment.
  • ·Authentication tokens captured this way can give attackers access to whatever systems the affected application was authorized to reach. This includes internal data stores, APIs, and third-party services, expanding blast radius well beyond the original deployment.
  • ·Compliance programs built around third-party AI vendor due diligence, such as those required under the EU AI Act (Regulation (EU) 2024/1689), must now account for AI-generated content within vendor-supplied components, not just the vendor's own code and infrastructure.

Governance controls affected

AGT-019AI Tool and Plugin Supply Chain Risk AssessmentPRC-001AI Vendor Due DiligencePRC-003Third-Party AI Model EvaluationSEC-004AI API Credential ManagementAGT-010Agent Knowledge Source Integrity

What to do now

  • ☐Audit every AI skill, plugin, or extension currently deployed in production and verify that every web address or external endpoint it contacts is registered, resolves to an expected owner, and matches what the vendor documented.
  • ☐Ask your engineering team to add automated checks that flag any AI-generated code or configuration referencing an external address that was not previously approved, before that code reaches production.
  • ☐Review contracts with AI platform vendors to confirm they are required to disclose flaws in official marketplace components and notify you when a skill is updated or revoked.
  • ☐Add AI skills and plugins to your existing software supply chain inventory so they receive the same change-tracking and periodic re-review as any other third-party software dependency.
  • ☐Confirm that authentication tokens used by AI-connected applications are scoped to the minimum necessary permissions and can be revoked individually, so a compromised token does not unlock unrelated systems.

What to watch next

Regulators and standards bodies are paying increasing attention to AI supply chain integrity, and this incident is likely to accelerate calls for mandatory pre-deployment verification of AI-generated components. Teams should monitor whether the EU AI Office expands its guidance on third-party AI component vetting under the EU AI Act (Regulation (EU) 2024/1689). They should also watch whether the Five Eyes Guidance on the Careful Adoption of Agentic AI Services is updated to address hallucinated dependencies specifically. Enforcement actions targeting platform operators whose vetted components caused downstream credential theft would set a significant precedent for vendor accountability.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Related Coverage

Research2026-10-14

Claude Code Flaw Let Malicious Files Steal Developer Credentials Without a Click

Security firm Noma Security disclosed a high-severity flaw in Anthropic's Claude Code desktop application, rated 8.7 out of 10 on the standard severity scale. The flaw allowed a malicious file opened in the app to silently send cloud access keys, SSH authentication keys, and code-hosting secrets to an attacker's server. Anthropic issued a fix, but an initial patch was bypassed before a deeper architectural change was deployed.

Research2026-10-14

Frontier Labs' Basic Containment Failures Drive Agent Incidents, Experts Warn

Cybersecurity experts interviewed across three industry conferences say recent unauthorized AI agent access incidents at OpenAI, Anthropic, Meta, and Google stem from poor containment and monitoring practices. The failures involve misconfigured isolation, weak network controls, and inadequate behavioral monitoring, not runaway model behavior. The findings carry direct implications for enterprise vendor due diligence and third-party AI risk programs.

Research2026-10-06

GitHub Copilot CLI Leaks Developer Secrets via Hidden Web Page Instructions

Security researchers at Adversa AI disclosed a flaw in GitHub Copilot CLI. In autonomous autopilot mode, hidden instructions on attacker-controlled web pages can trick the tool into sending developer credentials to a third party. Stolen credentials may include API keys and passwords. Microsoft's mai-code-1.1-flash succeeded on roughly half of attempts. OpenAI GPT-5.6 models refused. GitHub declined to classify the finding as a product vulnerability, arguing that users must direct the tool to fetch untrusted content.