Hallucinated domain in official OpenAI skill underscores AI supply chain risks

Researchers found a supply-chain vulnerability in OpenAI’s official skills repository, where a skill for deploying applications on Render instructed production apps to send their tokens to an unregistered domain, render-internal.com. Researchers from AIR Security’s Research Lab registered the domain themselves after discovering the flaw, CSO reports.