The dangerous dependency was not a package. It was a sentence.
An official AI deployment skill told an agent to send private service traffic to a domain that Render did not own. The agent copied that instruction into application code and deployment configuration. After researchers registered the domain, real production applications sent token-bearing requests outside their intended environment.
That meant whoever controlled the domain could receive authentication tokens and potentially use them to impersonate services or access protected resources, depending on each token’s permissions. Because the faulty instruction had already been converted into deployed code, correcting the original skill would not automatically repair affected applications or invalidate exposed credentials.
AIR Security disclosed the incident on October 14. The mistake had already been corrected before publication, but the incident demonstrates a durable problem: instructions can become infrastructure, and fixing the source does not automatically repair everything generated from it.
What Happened and Why It Matters
The skill told the agent to use render-internal.com for private service traffic. Render did not own that domain. The agent copied the address into application code and deployment configuration, and real applications later sent requests containing tokens to the domain after AIR Security registered it.
- The official skill named the domain.
- The agent treated the instruction as authoritative.
- The generated application trusted the resulting configuration.
- Runtime requests went to infrastructure outside the intended environment.
That means an error in trusted instructions crossed three boundaries. It moved from prose into generated code, from generated code into live infrastructure, and from live infrastructure into credential-bearing network traffic outside the intended environment.
This is more serious than a documentation typo. Deployment guidance can create persistent system behavior. A correction to the source does not automatically find every application generated from the old instructions, repair its configuration, or rotate credentials it may have exposed. Teams therefore need to review agent skills as dependencies and validate what those skills cause systems to build and trust.
A Trustworthy Source Can Still Contain the Wrong Address
The Render deployment skill described a private networking domain, render-internal.com, as though it were part of Render's internal infrastructure. It also included sample configuration showing the same hostname in service URLs and database connection strings.
According to AIR Security, Render did not use that domain for private service networking. The hostname was not an obscure misprint in documentation that nobody followed. When the researchers gave Codex a straightforward deployment task, it reproduced the bad value in generated code and environment configuration.
That is the moment the incident changes from a documentation mistake to an operational security failure.
The skill provided information. The agent treated that information as authoritative deployment guidance. Generated artifacts preserved the mistake. Runtime applications then trusted the endpoint, and their requests carried sensitive tokens outside the intended environment.
Nobody needed to trick the model with an obviously hostile prompt. No special autonomous ambition was necessary. The mistake originated in material the agent had been invited to trust.
The timeline is important. AIR Security says the vulnerable guidance dated to January 27, 2026. Render removed the bad references on August 14, OpenAI removed the associated plugin on August 26, and the domain was transferred into Render's safe holding. The October 14 publication disclosed an already-remediated problem, not a newly discovered open domain waiting for someone to register it.
The Supply Chain Includes Instructions
Software supply-chain programs track packages, versions, maintainers, signatures, and known vulnerabilities. Agent skills are often treated as something softer: a set of instructions that helps the model do its job.
But deployment instructions can become production behavior.
A skill may name the service endpoint, choose an authentication mechanism, establish environment variables, generate an infrastructure file, or supply a shell command. Those details do not stay inside a conversation. They can become executable artifacts whose consequences persist long after the agent stops running.
This gives security teams a more useful question than whether an agent installed an official skill:
Can you verify every external resource that the skill causes your system to trust?
The inventory needs more than the skill's name. It needs its version, maintainer, referenced domains, ownership checks, sensitive values copied into generated files, review status, and the configurations actually deployed.
In the Render case, a simple domain-ownership check and deployment artifact validation could have exposed the risk before production traffic followed the bad address. The case also demonstrates why remediation should include a lookback: fixing a skill does not automatically repair code and configurations previously generated from it.
A Different Boundary Failure: The Allowed Server That Sends Data Elsewhere
Two days earlier, AIR Security published separate research on Vercel Sandbox. It demonstrated a bypass of outbound domain allowlisting that did not require the agent to contact the forbidden destination directly.
The researchers described an environment where a compromised agent could reach an approved server using mutual TLS. A crafted client certificate contained an Authority Information Access URL. During certificate validation, the allowed server retrieved that URL, unknowingly passing information encoded in the request to an attacker-controlled destination.
The sandbox blocked direct off-list traffic. The indirect request happened outside the sandbox, at a service that was allowed to receive the agent's traffic.
This second finding must be characterized carefully. AIR Security demonstrated a plausible exploitation path in a controlled test. Its publication did not establish an actual compromise of Vercel customers. It also relied on an allowed destination that processes client certificates and retrieves the relevant certificate URL. This is not proof that all sandboxes fail or that the agent escaped its virtual machine.
Still, the design lesson is substantial: an allowed connection can create an unexamined onward path. Network policy expressed as a hostname allowlist does not necessarily govern what a permitted remote service does after receiving attacker-controlled input.
Two Failures, One Design Principle
These cases are not the same vulnerability.
In the Render case, a trusted instruction source specified an incorrect destination, and production systems sent real requests to it.
In the Vercel research, the first-hop destination was permitted. Information could leave through a second-hop request that the originating sandbox did not control.
The shared problem is transitive trust. A security decision made about one object, whether an official skill or an approved endpoint, is mistakenly treated as proof about everything that object might cause the rest of the system to do.
For AI deployments, useful safeguards include:
- Versioning and reviewing agent skills as first-class dependencies, including the domains, repositories, APIs, and configuration examples they reference
- Checking generated infrastructure artifacts before deployment rather than assuming official guidance produces safe production configuration
- Minimizing and rotating credentials, particularly if a service has contacted an unexpected endpoint
- Reviewing indirect outbound requests from approved services and the resulting information flows, not only the initial allowlist
- Preserving logs that connect a source instruction, agent action, generated artifact, and observed runtime connection
None of these requires abandoning agents or pretending every technical control can prevent every attack. They require documenting the real path between permission and consequence.
The instructions are part of the system. So is the infrastructure that executes them.
Sources and Reporting Notes
The Render incident and remediation timeline come from AIR Security's October 14 disclosure. The indirect allowlist-bypass demonstration comes from AIR Security's October 12 Vercel Sandbox research. The second publication describes a controlled technique, not evidence of a known customer compromise.