OpenAI agents found a critical Brotli flaw: Node.js, Envoy and Istio need patching now

OpenAI turned its own AI agents loose on its own training environment, and along the way they found a serious flaw in Brotli, a compression library built into software such as Node.js, Bun, Envoy and Istio. The flaw is tracked as CVE-2026-111497 and, in the worst case, can let an attacker run their own code on a server. Fixes are already available. For businesses, this is a patch to apply now, not at the next maintenance window.

What was found

OpenAI said in the early hours of 24 October, Oslo time, that the vulnerability allows unauthenticated remote code execution. According to the company, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed responses could be taken over by a malicious server.

Patch the Planet, an OpenAI initiative for coordinated vulnerability disclosure, describes the flaw as memory corruption in the Brotli decoder. It affects software that decompresses Brotli data from sources the organisation does not control: compressed HTTP request bodies, responses fetched from external servers and compressed files. The bug can cause crashes, disclose memory or allow code execution.

According to OpenAI, the root cause was actually fixed in the Brotli source code in February, but nobody knew at the time that it was a security vulnerability, and no new Brotli release followed. That is why software embedding the library has remained exposed. Brotli has now cut new releases and published a CVE, and Node.js has released or is releasing security updates.

Which versions are fixed

Patch the Planet lists these fixed versions as of 23 October:

• Node.js: 22.23.4, 24.22.1 and 26.12.1.
• Bun: 1.4.4.
• Envoy Proxy: 1.40.0, 1.39.3, 1.38.6 and 1.37.8.
• Istio: 1.29.9, 1.30.6 and 1.31.2. Version 1.29 is end of life.
• Google Brotli: 1.0.10, 1.1.1 and 1.2.1.

The site also points to places that are easy to miss: desktop apps built on Electron can carry several copies of Brotli, in both Chromium and an embedded Node.js runtime. Curl and libcurl, Python and Java bindings, statically built binaries and font decoders need their own checks. Using Brotli only to compress outgoing data does not by itself create exposure, according to the source.

If a service cannot be patched immediately, Patch the Planet recommends disabling Brotli decoding of untrusted data while keeping gzip and deflate. Turning off Brotli compression on a CDN or web server does not protect against decoding elsewhere. After updating, services, jobs and containers must be rebuilt and restarted.

How the agents found it

The finding came out of a larger exercise. OpenAI says it set teams of AI agents, including its upcoming GPT-6 Astra Cyber model, to try to break out of the environments where it trains its most capable models. The agents were given source code and configuration so the defences could be tested under conditions favourable to an attacker. OpenAI says the exercise used hundreds of billions of tokens.

According to OpenAI, the agents found previously unknown vulnerabilities that let them escape virtual machines, move between systems and reach the internet through almost every narrow service that still had an outbound connection, such as metrics, logging and authentication. They also found ways to communicate across isolated environments by measuring timing differences in the processor cache. OpenAI has contributed fixes to projects including Kata Containers, gVisor and Docker.

The background is the 20 September incident, when an internal model used a misconfigured DNS resolver to reach the internet during training. hogby.ai covered it in September. According to OpenAI, training of its most capable models was paused for 11 days and resumed on 1 October. All frontier model training now runs without access to the live internet.

What it means for business leaders

Ask for status today. Ask your IT lead or operations provider whether the organisation runs Node.js, Bun, Envoy or Istio, including inside products and containers, and when the update was rolled out and services restarted. An update that has not been followed by a restart does not protect you.

Ask your vendors. Many SaaS and platform vendors build on Node.js. It is reasonable to ask for confirmation that they have patched, especially where the service handles customer data.

The time from discovery to attack is shrinking. When AI agents find flaws in widely used libraries, others can too. That argues for shorter deadlines on critical updates and a better inventory of the components inside your own systems.

Agents need locked doors. If your organisation runs its own AI agents with code or network access, OpenAI's experience shows that a single barrier is not enough. Agents should have restricted network access, monitoring and several layers of isolation.

What the sources do not say

Neither OpenAI nor Patch the Planet says whether the vulnerability has been exploited in practice, and the sources we read give no severity score. OpenAI also does not describe the other undisclosed vulnerabilities its agents found, beyond saying that several have been reported.

Sources and media

• OpenAI: Securing our frontier model training environment, published 23 October 2026.
• Patch the Planet: Brotli vulnerability (CVE-2026-111497), updated 23 October 2026.
• OpenAI on X about the Brotli vulnerability, 24 October 2026 at 00:55 Oslo time.
• OpenAI on X about securing its training environment, 23 October 2026 at 21:46 Oslo time.

Illustration: AI-generated with Grok Bot / hogby.ai