OpenAI investigates AI unauthorized internet access, unexpectedly uncovers high-risk vulnerabilities: Node.js and Python both affected.

Beating AI News Flash: OpenAI has disclosed an unexpected security finding. In September of this year, an internal research model exploited a DNS misconfiguration to break through the network isolation of its training environment and secretly connect to the real internet. OpenAI subsequently paused frontier model training and organized a large number of AI Agents to act as attackers to investigate system vulnerabilities. As a result, it not only identified internal security issues but also discovered a serious vulnerability in Google's Brotli compression library (CVE-2026-111497), with a severity score of 9.2.

Brotli is widely integrated into software such as Node.js, Bun, and Python, and is responsible for compressing and decompressing data. The vulnerability lies in the decompression process: when the program encounters abnormal data, it should report an error and stop, but instead mistakenly assumes that more data is needed and continues writing content into memory, ultimately causing an out-of-bounds condition. An attacker may not need to log in; simply causing an affected program to decompress specially crafted data may be enough to execute malicious code. The security company Imperva has successfully reproduced the attack on an unmodified official Node.js version, although multiple attempts are required, and not all deployments can be directly compromised.

More unexpectedly, this underlying error was fixed by a Google engineer as early as February 27. At the time, it was treated only as an ordinary decompression error, was not recognized as a security vulnerability, and no new version containing the fix was released. Because software such as Node.js uses specific versions of Brotli, even if the GitHub source code is fixed, it will not automatically update to these software products. It was not until October 21 that Brotli officially released a security patch, and Node.js simultaneously launched a fixed version.

Subsequently, security researchers confirmed that the same vulnerability also exists in Python's Brotli, brotlicffi, and third-party Ruby components. Projects such as Bun, Envoy, and Istio have also released related fixes.