AI Governance Institute
← News
Research2026-10-16

Hallucinated OpenAI Skill Domain Captured Real Authentication Tokens From Live Apps

What happened

Security researchers at AIR Security disclosed that an official OpenAI skill designed for use with the Render cloud platform contained a domain name that did not exist. The AI had invented the domain during the skill's creation. The finding is documented in the Hallucinated domain in official OpenAI skill underscores AI supply chain risks report published October 16, 2026. The fabricated address was not a typo or a draft artifact. It appeared in code that told production applications to send authentication tokens to that address. Authentication tokens are the digital keys applications use to prove their identity and access protected systems. The researchers registered the domain themselves and received real tokens from real applications that had already deployed the skill. The incident follows a broader pattern of AI supply chain vulnerabilities, including 68 MCP Server CVEs in One Month and the Plugin4Shell flaw that broke approved-plugin controls. It illustrates that AI-generated components can carry plausible-looking but dangerous errors even when they pass vendor review.

Why it matters

  • ·Vendor-vetted does not mean safe. An official skill cleared by a major AI platform still contained a credential-stealing flaw. Organizations cannot rely on marketplace approval as a substitute for their own testing before deployment.
  • ·Authentication tokens captured this way can give attackers access to whatever systems the affected application was authorized to reach. This includes internal data stores, APIs, and third-party services, expanding blast radius well beyond the original deployment.
  • ·Compliance programs built around third-party AI vendor due diligence, such as those required under the EU AI Act (Regulation (EU) 2024/1689), must now account for AI-generated content within vendor-supplied components, not just the vendor's own code and infrastructure.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-019AI Tool and Plugin Supply Chain Risk AssessmentPRC-001AI Vendor Due DiligencePRC-003Third-Party AI Model EvaluationSEC-004AI API Credential ManagementAGT-010Agent Knowledge Source Integrity

What to do now

  • ☐Audit every AI skill, plugin, or extension currently deployed in production and verify that every web address or external endpoint it contacts is registered, resolves to an expected owner, and matches what the vendor documented.
  • ☐Ask your engineering team to add automated checks that flag any AI-generated code or configuration referencing an external address that was not previously approved, before that code reaches production.
  • ☐Review contracts with AI platform vendors to confirm they are required to disclose flaws in official marketplace components and notify you when a skill is updated or revoked.
  • ☐Add AI skills and plugins to your existing software supply chain inventory so they receive the same change-tracking and periodic re-review as any other third-party software dependency.
  • ☐Confirm that authentication tokens used by AI-connected applications are scoped to the minimum necessary permissions and can be revoked individually, so a compromised token does not unlock unrelated systems.

What to watch next

Regulators and standards bodies are paying increasing attention to AI supply chain integrity, and this incident is likely to accelerate calls for mandatory pre-deployment verification of AI-generated components. Teams should monitor whether the EU AI Office expands its guidance on third-party AI component vetting under the EU AI Act (Regulation (EU) 2024/1689). They should also watch whether the Five Eyes Guidance on the Careful Adoption of Agentic AI Services is updated to address hallucinated dependencies specifically. Enforcement actions targeting platform operators whose vetted components caused downstream credential theft would set a significant precedent for vendor accountability.

Related Coverage

Research2026-10-28

Six Named AI Attack Techniques Show Governance Programs Are Targeting the Wrong Threat

CSO Online has cataloged ten attack techniques used against enterprise AI infrastructure. These include a fake MCP server impersonating Postmark and malware hiding attacker commands inside the OpenAI Assistants API. CVE-2025-32711 is a flaw in Microsoft 365 Copilot that lets attackers steal data via email. The real attack surface has shifted to AI tooling, agent permissions, and supply chain integrity. Most enterprise AI governance programs remain focused on model-level risks and have not kept pace.

Corporate Policy2026-11-02

Trigger.dev Breach Exposes Credential Risk in AI Workflow Platforms

Trigger.dev, a cloud-hosted AI agent and workflow orchestration platform, disclosed that attackers obtained environment variables from a subset of customer accounts. The stolen configuration values included credentials for connected services such as Stripe, Supabase, and Slack. Enterprise compliance teams should treat third-party AI orchestration platforms as credential custodians and review controls accordingly.

Research2026-11-02

LLMJacking Costs Hit $100K Per Day as Criminal Ecosystem Matures

Google Mandiant has documented a growing criminal practice called LLMJacking, in which attackers steal corporate AI access keys to run unauthorized AI workloads at victims' expense. Losses can exceed $100,000 per day and reach $1 million before the victim detects the fraud. Mandiant found a structured criminal ecosystem with specialists for stealing keys and separate operators for monetizing them.