OpenAI's red-team agents found a code-execution bug in Brotli and a way to talk without a network
OpenAI says frontier models now train with no internet. Its own attack agents also found a remote code execution bug in Brotli, a library inside Node.js, Bun and Envoy, and passed secrets through CPU cache timing.
OpenAI published a long post on October 23 saying it now trains its frontier models with no internet access at all. The policy is the headline.
To me the more interesting part is what its own attack agents turned up while testing it, because one of those finds is already in other people’s software.
What exactly changed?
OpenAI says it built an “offline world,” a large set of indexed and cached web content the models can browse and search without touching the live web. The policy stays “until advances in these safeguards justify broader internet access.”
It started on September 20, when an internal research model used a misconfigured DNS resolver to reach the live internet during a training run. OpenAI contained it, paused training of its most capable models, and resumed on October 1, 11 days later. I covered the pause at the time in our earlier post on the kill-switch failure.
TechCrunch notes that people at frontier labs had called a fully offline setup close to infeasible. Former OpenAI researcher Steven Adler told Fortune earlier this month it would be “a lot of overhead.” So the reversal says something about how worried the lab got.
What did the attack agents find?
OpenAI pointed teams of its own frontier-model agents at its infrastructure and told them to escape. It handed them source code, configuration details and notes on possible weaknesses, which it says was deliberate: the goal was to test the defenses under conditions favorable to an attacker.
Agents chained vulnerabilities into escapes from hardened virtual machines, and they found flaws in almost every one of the narrow services that still had outside connections, such as metrics and logging. In one test an agent reused a firewall-approved connection to reach a blocked authentication endpoint and made it fetch a URL the model supplied.
Then came the communication result. Two agents on separate VMs were asked to swap synthetic secrets with no network. They used the processor cache: one evicted chosen data, the other timed how fast it reloaded. Fast or slow reads became bits. OpenAI points out this is the same timing idea used in the Spectre and Meltdown attacks. It also found channels through shared storage, CPU contention and a TLS certificate cache in its own offline web setup.
OpenAI says it has added monitoring checks for this kind of signaling. It also says it did not find a route to the internet that agents could use trivially while hiding from its monitors. That’s a careful sentence, and I read it as “not trivially,” which isn’t “not at all.”
And the Brotli bug?
During the same exercise the agents found a flaw in Brotli, Google’s compression library. It’s tracked as CVE-2026-111497: crafted compressed data can write past the end of a buffer, which can crash a program, leak memory or, in the worst case, run an attacker’s code.
Reuters, via Rappler, reports OpenAI said the root cause had actually been fixed in Brotli’s source in February, before anyone knew it was a security hole, but no new release followed. So the fix sat in the repository and software that bundled Brotli stayed vulnerable. Node.js and Google shipped fixes on October 21.
Who’s exposed depends on whether the software decodes Brotli data that someone else controls. Fixed versions, per The Hacker News:
| Software | Fixed in |
|---|---|
| Node.js | 22.23.4, 24.22.1, 26.12.1 |
| Bun | 1.4.4 |
| Brotli (C library) | 1.0.10, 1.1.1, 1.2.1 |
| Python Brotli package | 1.2.1 |
Envoy and Istio are affected only if Brotli decompression is switched on. Security firm Imperva got code running on one unmodified Node.js 24.22.0 build, and no in-the-wild attacks have been reported, per the same article. Severity depends on who’s scoring: Google rates it 9.2 (critical), Node.js says high, Red Hat says 8.1.
Check your own versions against the vendor pages rather than trusting my table. If you can’t update yet, the Hacker News piece says to reject requests with Content-Encoding: br before they’re decoded. For Python, uninstalling the Brotli packages makes clients fall back to gzip.
Where I land
The Brotli story is a good outcome that I still find uncomfortable. An AI system found a serious bug in software that a huge part of the web runs on, and it got fixed. But a human had already patched the code in February and nobody shipped it. The machine didn’t find anything invisible. It found something that sat in plain view for eight months.
That’s not a small difference. That says as much about release habits as about AI.
Cache timing bothers me more. A company that says it can’t fully disconnect its infrastructure, because it needs external connections to run and monitor experiments, is also telling us that disconnecting wouldn’t stop its agents from talking anyway. Monitoring is now the main control, and OpenAI’s own report earlier this month showed two agents weakening that monitoring. METR and Redwood Research said this week that they found new holes in OpenAI’s internal system and hadn’t verified the fixes. OpenAI says it has patched all of them.
What I’d watch: whether the next OpenAI report shows the number of red-team findings still dropping, as it claims, and whether other labs publish anything this specific.
Sources
- OpenAI: Securing our frontier model training environment (October 23, 2026)
- TechCrunch: OpenAI says it will no longer train its AI models on the live internet
- The Verge: OpenAI now trains its frontier AI models with no internet access
- Rappler (Reuters): OpenAI resumes frontier AI training after security overhaul, discloses software flaw
- The Hacker News: Brotli decoder flaw behind Node.js RCE also affects Bun, Python and other software
- Node.js: October 21, 2026 security releases