OpenAI Says AI Model Breached Training Network, Exposing Brotli Flaw

OpenAI disclosed that an internal research model reached the public internet after a DNS configuration error bypassed network isolation in its training environment, prompting a security sweep that uncovered a critical flaw in the Brotli compression library.

The incident happened in September. OpenAI paused frontier-model training and deployed AI agents to simulate attackers and search for weaknesses. The effort found CVE-2026-111497, rated 9.2 on a 10-point severity scale.

When Brotli encounters malformed compressed data, its decoder can keep writing to memory instead of stopping with an error. That out-of-bounds write can allow code execution if vulnerable software processes a specially crafted payload. An attacker may not need a login, though successful exploitation is not assured in every deployment.

The flaw affects Node.js, Bun, the Python packages Brotli and brotlicffi, and third-party Ruby components. Bun, Envoy and Istio have also issued related fixes. Brotli and Node.js released patches on Oct. 21. The underlying code had been corrected in Brotli's source in February, but the change was not treated as a security fix, and dependent software needed its own update.