# OpenAI Sesame: an official skill sent app tokens to an unowned domain

> OpenAI Sesame is a dangling-domain flaw: an official OpenAI skill pointed coding agents at render-internal.com, which Render did not own.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Supply chain, Vulnerability
- **Published by:** AIR Security
- **Disclosed:** 2026-10-09
- **Affects:** OpenAI Codex, openai/plugins, Render
- **Research by:** Eliad Mualem, Dor Granat
- **Primary source:** https://air.security/blog-posts/render-openai
- **Page:** https://theinjection.dev/items/air-openai-sesame-render-skill/

OpenAI Sesame is a flaw in render-deploy, an official OpenAI skill that told coding agents Render private services sit at render-internal.com, a domain Render did not own. AIR Security registered it and received live bearer tokens.

## What happened

AIR Security published OpenAI Sesame on October 9, 2026. Eliad Mualem and Dor Granat found that render-deploy, an official skill in the openai/plugins repository, told agents that Render private services are reached at [service-name].render-internal.com. AIR says the domain appears in none of Render's documentation, and the guidance dates to the skill's first commit on January 27, 2026.

## How it works

The skill shipped instructions naming a domain that nobody had registered. In AIR's test, Codex carried render-internal.com into generated application code and deployment configuration as a default, so deployed apps resolved it at runtime. AIR then registered the domain and pointed it at a passive sinkhole that answered on every subdomain and port, where it recorded HEAD and GET requests carrying Authorization Bearer headers from real applications.

## Who is affected

Developers who deployed to Render using the render-deploy skill, and any application whose code or deployment configuration still names render-internal.com. AIR reports real victims in the wild but publishes no count of affected services or leaked tokens.

## What to do

Update to the patched version of the skill, as AIR advises, and search application code and deployment configuration for render-internal.com. Rotate any credential an app may have sent to that domain. AIR also recommends validating the external dependencies a skill names and watching those domains for ownership changes.

## Quick facts

- **Affected:** render-deploy skill in openai/plugins
- **Attack type:** Unregistered domain named in official skill guidance
- **Found by:** Eliad Mualem and Dor Granat, AIR Security
- **Disclosed:** October 9, 2026
- **Introduced:** January 27, 2026, the skill's first commit
- **Fixed in:** Render removed the references on August 14, 2026
- **Status:** Plugin removed from openai/plugins on August 26, 2026, domain transferred to Render, no CVE

## Questions

### Am I affected by the OpenAI Sesame skill flaw?

Applications are affected if they were built or deployed with OpenAI's render-deploy skill and still reference render-internal.com in code or deployment configuration. AIR Security found that Codex inserted the domain as a default, so the string may sit in a config file nobody reviewed. Searching a repository for the domain is the fastest check, and AIR reports it saw requests from real production apps.

### Is the render-deploy skill fixed?

Render fixed the skill on August 14, 2026 by removing every render-internal.com reference, according to AIR Security, and OpenAI removed the Render plugin from openai/plugins on August 26, 2026. AIR also says the domain was transferred to Render, so an outside party can no longer receive the traffic. Applications already generated with the old guidance still need fixing by their owners.

### Should I rotate tokens after the OpenAI Sesame disclosure?

Rotating is the safe choice for any credential an affected app could have sent to render-internal.com, because AIR Security recorded live Authorization Bearer headers arriving at the domain it controlled. AIR does not say how many tokens it saw or name the services it observed, so an owner cannot tell from the write-up alone whether one specific token was exposed.

### How does OpenAI Sesame differ from Plugin4Shell?

Plugin4Shell, also from AIR Security, let repository owners swap pinned plugin code in four AI coding agents without any user click. OpenAI Sesame needs no code swap, because the official skill's own text named a domain that was free for anyone to register, and the agent then copied that domain into the applications it generated. One hijacks code, the other follows trusted guidance.

## Sources

1. [AIR Security Write-Up](https://air.security/blog-posts/render-openai)
2. [OpenAI Plugins Repo](https://github.com/openai/plugins)
3. [Plugin Removal Commit](https://github.com/openai/plugins/commit/33bd9529)