OpenAI says its containment red teaming also found an unauthenticated remote code execution flaw in Brotli, the compression library inside Node.js, Bun and Envoy
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server. This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE. More details on the patch and mitigations below:
Context
Brotli is built into a lot of internet software, so one decoder bug reaches servers and clients alike. It is also a concrete case of AI driven security testing turning up a real, widely shared flaw.
The post quotes OpenAI's earlier thread about the offline training world it built after pausing frontier training, which is covered in the containment story in this deck. The flaw is tracked as CVE-2026-111497, which some researchers call Node2Shell, and Node.js credited OpenAI Codex Security when it shipped fixes on October 21. The post was published at 6:55 PM Eastern on October 23.
Deep dive
OpenAI posted at 6:55 PM Eastern on October 23 that, during the red teaming of its new training containment, it also found a vulnerability that allows unauthenticated remote code execution in Brotli. Brotli is a widely used compression library, and OpenAI named Node.js, Bun and Envoy as software that includes it.
OpenAI's description: an attacker could send or reply with malicious compressed data and run their own code, with no user account needed. An unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client, such as curl with compression turned on, could be taken over by a malicious server. OpenAI says the root cause was fixed in Brotli's source code in February, but nobody knew it was a security issue and no release followed. After OpenAI's disclosure, Brotli cut new versions and published a CVE.
Outside records line up with that account. The Node.js security release on October 21 lists a high severity Brotli decoder out of bounds write, CVE-2026-111497, and thanks OpenAI Codex Security researchers for reporting it. The OSV database lists fixed Brotli versions 1.0.10, 1.1.1 and 1.2.1 and an upstream CVSS 4.0 score of 9.2. The Hacker News reports that Imperva researchers ran code on one unpatched Node.js build, that the exploit has not been released, and that no attacks in the wild have been reported.
The disclosure was public before this post; what is new on October 23 is OpenAI's own account linking the find to its containment testing.
What to expect next
Because each program ships its own copy of the Brotli decoder, fixes arrive product by product, so expect more vendor advisories for software that bundles it. Teams should update Brotli and Node.js to the fixed versions and rebuild any container images that include the library. Where an update is not yet possible, the guidance cited in coverage is to stop decoding untrusted Brotli data. A separate question is whether OpenAI publishes more of what its agents found during the containment exercise, since it says other flaws were fixed.