What happened
On Oct 23, OpenAI described how it protects the computers it uses to train its most capable models. It says frontier training runs have no live internet access and instead use an 'offline world' of cached web content. After a DNS misconfiguration on Sept 20, OpenAI paused training and resumed it on Oct 1.
OpenAI says it then pointed its own red-team AI agents at that setup. They found problems such as ways to escape lightweight virtual machines and cache-timing side channels, and OpenAI says it sent fixes to open-source projects including Kata Containers, gVisor and Moby.
The Brotli bug
In a post on X the same day, OpenAI said the exercise also found a bug in Brotli, a widely used compression library, that allows remote code execution without logging in. It says a malicious client could take over an unpatched server, or a malicious server could take over an unpatched client, and that Node.js, Bun and Envoy are affected.
Node.js lists the bug as CVE-2026-111497, rated high, in its Oct 21 security releases, credited to OpenAI Codex Security. Brotli itself shipped fixed versions 1.2.1, 1.1.1 and 1.0.10 on Oct 21.
What to do
If you run anything on Node.js, update to v22.23.4, v24.22.1 or v26.12.1 or later. If you use Bun, update to 1.4.4; Bun says its fetch decodes Brotli responses automatically, suggests decompress: false as a stopgap, and says apps built with bun build --compile must be rebuilt.
If someone else hosts your site or app, ask them in writing whether Node.js, Bun, Envoy or Brotli are in the stack and whether they are patched. Our website security playbook walks through how to ask and keep a record.
What we couldn't confirm
None of the pages we read say whether this bug has been exploited in the wild. We did not check which Envoy versions are affected or read OpenAI's longer write-up of the Brotli bug, so we don't repeat details from them. OpenAI's own training page doesn't name Brotli; that link comes from its X post.