← All incidents

OpenAI's official Render deploy skill pointed apps at render-internal.com, a domain Render didn't own

Research · render-deploy skill (openai/skills, openai/plugins, render-oss/skills) used by coding agents such as Codex · MEDIUM

Summary

AIR Security, a security vendor, disclosed on Oct 14, 2026 that render-deploy, a Render-authored skill carried in OpenAI's official skills and plugins repositories, told coding agents that Render's private services live at [service-name].render-internal.com, with copy-paste code and a database URL using that domain. Render doesn't use that domain for private networking, and it was unregistered. AIR says that when it asked Codex to deploy two services with the skill, the domain ended up as a default in both the generated code and the deployment config. AIR says that after it registered the domain and pointed it at a passive sinkhole, apps sent it token-bearing API calls. AIR gives no count of apps or calls and doesn't say what kinds of tokens. There is no report of an attacker receiving any tokens: the domain was held by AIR's sinkhole, and AIR reports the domain is now controlled by Render, so current risk is low. Render removed the references from its own skill repository on Aug 14, 2026, and OpenAI removed the Render plugin from openai/plugins on Aug 26, 2026. As of Oct 16, the repo still contains 7 references to render-internal.com: the curated render-deploy copy in openai/skills, unchanged since commit bf9e226 (Feb 2, 2026). We'll update this entry if this changes.

Severity

Timeline

1. Jan 27, 2026
   The render-internal.com guidance is in Render's render-deploy skill from its initial commit (per AIR Security).
2. Feb 2, 2026
   Last commit touching the curated render-deploy copy in openai/skills (bf9e226).
3. Mar 13, 2026
   The skill is bundled into the Render plugin in openai/plugins (per AIR Security).
4. Aug 14, 2026
   Render removes the render-internal.com references from render-oss/skills (commit 5152e543, 'Update Guidence on Internal Addresses').
5. Aug 26, 2026
   OpenAI removes the Render plugin from openai/plugins (commit 33bd9529).
6. Oct 14, 2026
   AIR Security publishes its write-up.
7. Oct 16, 2026
   CSO Online covers it. As of Oct 16, the openai/skills repo still contains 7 references to render-internal.com.

How it happened

The skill's reference files (references/service-types.md and references/configuration-guide.md) presented render-internal.com as Render's private DNS and included example code (const API_URL = 'http://internal-api.render-internal.com:10000') and a database URL (postgres.render-internal.com). Render's private network actually uses per-service internal addresses shown in the dashboard. Because agents treat skill text as trusted instructions, the made-up domain could be written into generated code and render.yaml as a default, so an app that never overrode it would send requests, including bearer tokens, to whoever owned the domain. The sinkhole observations come from AIR Security, a vendor that sells security products, which gave no count. As of Oct 16, the repo still contains 7 references to render-internal.com: <a href="https://github.com/openai/skills/blob/bf9e226541ec801750547acfa8cf761b7c878f27/skills/.curated/render-deploy/references/service-types.md">service-types.md</a> (4) and <a href="https://github.com/openai/skills/blob/bf9e226541ec801750547acfa8cf761b7c878f27/skills/.curated/render-deploy/references/configuration-guide.md">configuration-guide.md</a> (3) at commit bf9e226. We'll update this entry if this changes.

How to check your app

• Update the render-deploy skill from Render's repository (render-oss/skills), which no longer references render-internal.com. Don't rely on the curated copy in openai/skills until it's updated.
• Use the internal address Render shows in each service's Connect menu (Internal tab) for service-to-service traffic, per Render's private network docs.
• Search your code, render.yaml and environment variables for render-internal.com. If any app called a render-internal.com host, rotate the tokens or keys those requests carried.
• If you installed skills locally, grep your skills folders for render-internal.com.

Sources

• AIR Security research post (vendor, primary, Oct 14, 2026)
• CSO Online (Oct 16, 2026)
• Render fix commit 5152e543 (render-oss/skills, Aug 14, 2026)
• OpenAI commit 33bd9529 removing the Render plugin (openai/plugins, Aug 26, 2026)
• openai/skills curated render-deploy service-types.md at commit bf9e226 (still references render-internal.com as of Oct 16, 2026)
• Render docs: private network internal addresses

Corrections and updates

None. Re-checked against every source on Oct 16, 2026.