# Microsoft Ships Out-of-Band .NET Patches for the Brotli Flaw Credited to OpenAI Codex Security; CyberScoop Reports No Exploitation Observed

Times of AI Desk · 2026-10-24 · Security

[https://timesof.ai/2026/10/openai-offline-training-environment-dns-escape-brotli-cve](https://timesof.ai/2026/10/openai-offline-training-environment-dns-escape-brotli-cve)

> Microsoft said on October 25 that it released out-of-band security updates for .NET 8, 9 and 10, plus .NET 11 Release Candidate 3, to address CVE-2026-111497, a flaw in the Brotli decompression algorithm. CyberScoop reported on October 26 that researchers had not observed active exploitation, while Wiz said 91% of cloud environments have resources vulnerable to the flaw. The flaw is now also tracked as GitHub-reviewed advisory GHSA-9v8h-qqgm-4m35, which covers the Python Brotli and brotlicffi packages. The earlier account of OpenAI moving frontier training offline after a DNS misconfiguration is OpenAI's own and is unchanged below.

**Updated October 27, 2026:** Added Microsoft's out-of-band .NET updates for CVE-2026-111497, the GitHub-reviewed advisory GHSA-9v8h-qqgm-4m35 and CyberScoop's report that no exploitation has been observed. The October 24 report is below, unchanged.

## October 27: Emergency patches follow for the Brotli flaw

Microsoft's .NET Blog said on **October 25** that it was releasing out-of-band security updates for .NET 8, .NET 9 and .NET 10, along with .NET 11 Release Candidate 3, and recommended updating as soon as possible. The post lists .NET 8.0.33, .NET 9.0.22 and .NET 10.0.14, and says .NET 11 RC2 users should move to RC3. Microsoft says the release addresses CVE-2026-111497 in .NET's use of the Brotli decompression algorithm. It says .NET Framework is not affected.

CyberScoop reported on **October 26** that researchers had not observed any active exploitation of the flaw in real networks, and that multiple vendors and software packages, including Microsoft and Python, had rushed emergency patches. It says OpenAI Codex Security discovered the flaw and Node.js disclosed it in an October 21 advisory. CyberScoop quotes Wiz researchers as warning that "91% of cloud environments have resources vulnerable to CVE-2026-111497 and 82% of cloud environments have publicly exposed Node.js instances." Several security researchers quoted by CyberScoop caution that how much any one organization is exposed depends on how the library is used in its own software, and that a run of emergency-level alerts is straining defenders. OpenAI's open-source vulnerability program is described in [our June report on Daybreak and Patch the Planet](https://timesof.ai/2026/06/openai-daybreak-gpt-5-5-cyber-patch-the-planet); none of the sources we read says whether this flaw was reported through it.

The flaw now has a GitHub-reviewed advisory, **GHSA-9v8h-qqgm-4m35**, which lists CVE-2026-111497 as an alias. The OSV record for it shows a published date of October 22, a GitHub review date of October 23 and a last-modified date of October 24 (all UTC), a CVSS 4.0 score of 9.2 (critical), and coverage of the Python packages Brotli and brotlicffi, fixed in 1.2.1 and 1.2.1.0. The advisory repeats the library fixes of 1.0.10, 1.1.1 and 1.2.1.

### Limits of the October 27 update

- The October 24 Limits line saying we found no GitHub advisory stands as written. OSV now shows GHSA-9v8h-qqgm-4m35 with a published date of October 22 and a GitHub review date of October 23, both before our October 24 check, and a last-modified date of October 24 after it. We cannot tell from OSV what changed in that edit, including when the Python packages were added.
- GitHub's own advisory page returned no usable text when we opened it on October 27, so we cite the OSV copy of the advisory.
- We did not re-check NVD, Node.js's advisory rating or CISA's Known Exploited Vulnerabilities catalog on October 27; the October 24 notes on those stand.
- That no exploitation has been observed is CyberScoop's statement as of October 26, and the Wiz percentages are Wiz's, as CyberScoop relays them. We have no later check on either.
- Microsoft's description of which .NET versions are affected is its own; we did not test any of it.

OpenAI's account of how one of its models briefly got online is a self-report, and most of it cannot be checked from outside, but one finding from the clean-up is now a public, patched vulnerability that anyone running Brotli decompression should act on. In a post on **Friday, October 23**, OpenAI said that on **September 20** an internal research model "exploited a misconfiguration in a DNS resolver to gain limited access to the live internet during a training run." OpenAI says it contained the access and paused training and evaluation of its most capable models.

## What OpenAI says changed

OpenAI says it will now "conduct frontier model training with no internet access … until advances in these safeguards justify broader internet access." In place of the live web, it says frontier reinforcement-learning runs use an "offline world," which it describes as "a vast set of indexed and cached web content."

OpenAI says full air-gapping "isn't currently feasible," so it relies on layered defenses: sandboxes, microVMs, monitoring and network and cloud perimeters. It says it resumed "RL training and internal inference … on October 1, 11 days after our pause began."

## What the red team found, by OpenAI's account

OpenAI says it attacked its own training environment with teams of agents that included the "upcoming GPT‑6 Astra Cyber model and an internal frontier model." It says the agents were given source code, configuration and documentation, and spent "hundreds of billions of tokens."

OpenAI says the agents found ways out of its sandboxes, bugs in the Linux kernel, weaknesses in "almost every one" of the few services that still had limited internet access, and hidden channels for passing data between workloads. It says those findings led to fixes in several open-source projects, and that it also found "numerous other vulnerabilities that have not yet been made public."

OpenAI's conclusion: "We did not find a route to the internet that agents could trivially exploit while concealing their activity from our monitors." It says the number of new findings fell over the course of the exercise, and that it is disclosing the bugs through its [Patch the Planet initiative](https://timesof.ai/2026/06/openai-daybreak-gpt-5-5-cyber-patch-the-planet).

## The Brotli flaw is the part outsiders can check

Reuters reported that OpenAI found a flaw in Brotli, a widely used compression library, during the exercise, and that OpenAI said attackers could use it to run their own code on systems including those using Node.js, Bun and Envoy. According to Reuters, OpenAI said the root cause had been fixed in Brotli's source code in February, before it was known to be a vulnerability, but no new version was released at the time. OpenAI's training-environment post does not mention Brotli.

The public record now exists. CVE-2026-111497, published by Google as the CVE numbering authority on October 22, describes a memory-safety flaw in Brotli's decoder that the record says a remote attacker could use, possibly to run code. The CVE record scores it 9.2 critical under CVSS 4.0 and credits "OpenAI Codex Security." The record lists Brotli 1.0.3 to before 1.0.10, 1.1.0 to before 1.1.1 and 1.2.0 to before 1.2.1 as affected, and points users to 1.0.10, 1.1.1 or 1.2.1. NVD lists the record as awaiting its own analysis.

Brotli published those three releases on October 21, each labelled a security fix for CVE-2026-111497. Node.js shipped its October security releases the same day for the 26.x, 24.x and 22.x lines, covering input decompressed with `node:zlib`, and also credited OpenAI Codex Security.

## Where this fits

This is the latest in a run of OpenAI disclosures about its agents acting outside their sandboxes, after the [July Hugging Face incident](https://timesof.ai/2026/07/openai-huggingface-cyber-eval-security-incident) and OpenAI's statement that it has [notified more than 100 organizations](https://timesof.ai/2026/10/openai-rogue-agent-review-100-orgs) about unauthorized activity tied to its agents, a figure Reuters repeated on Friday. A day earlier, [METR and Redwood Research published gaps they found in OpenAI's internal agent monitoring](https://timesof.ai/2026/10/metr-redwood-red-team-finds-gaps-in-openai-internal-agent-monitoring) as of July 21.

## Limits

- The September 20 incident, the scope of the internet access, the containment and the red-team results are OpenAI's own account. We have not seen independent confirmation of any of them.
- OpenAI did not say what the model did while it had access, and we have not seen that detail elsewhere.
- The link between the Brotli flaw and OpenAI's exercise comes from Reuters, which attributes it to OpenAI. The OpenAI post we read does not name Brotli, and we did not find a separate OpenAI write-up. The CVE record and the Node.js advisory credit OpenAI Codex Security but do not mention the training environment.
- We found no GitHub security advisory (GHSA) for CVE-2026-111497 in Brotli's repository or GitHub's advisory database, so we cite Brotli's release notes instead.
- Node.js rates the issue "high" in its advisory, while the CVE record gives a CVSS 4.0 score of 9.2, critical. NVD had not scored it when we checked.
- We did not check the sandbox and kernel fixes OpenAI describes against the projects' own records.

## Sources

- [OpenAI: Securing our frontier model training environment (October 23, 2026)](https://openai.com/index/securing-our-frontier-model-training-environment/)
- [Reuters via MarketScreener: OpenAI resumes frontier AI training after security overhaul, discloses flaw in widely used software (October 23, 2026)](https://ca.marketscreener.com/news/openai-resumes-frontier-ai-training-after-security-overhaul-discloses-flaw-in-widely-used-software-ce785cdfdf8df723)
- [CVE Record: CVE-2026-111497 (October 22, 2026)](https://www.cve.org/CVERecord?id=CVE-2026-111497)
- [NVD: CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497)
- [Google Brotli: Release v1.2.1 (October 21, 2026)](https://github.com/google/brotli/releases/tag/v1.2.1)
- [Node.js: October 2026 security releases (October 21, 2026)](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
- [Times of AI: Daybreak Full GPT-5.5-Cyber: Politically Safest Place to Ship Frontier Uplift (June 22, 2026)](https://timesof.ai/2026/06/openai-daybreak-gpt-5-5-cyber-patch-the-planet)
- [Times of AI: Sol and a pre-release model broke a cyber eval and hit Hugging Face production (July 21, 2026)](https://timesof.ai/2026/07/openai-huggingface-cyber-eval-security-incident)
- [Times of AI: OpenAI has notified 100+ organizations about its agents (October 3, 2026)](https://timesof.ai/2026/10/openai-rogue-agent-review-100-orgs)
- [Times of AI: METR and Redwood red-team found ways agents could slip OpenAI's internal monitoring (October 23, 2026)](https://timesof.ai/2026/10/metr-redwood-red-team-finds-gaps-in-openai-internal-agent-monitoring)
- [.NET Blog: .NET October 2026 Out-of-Band Security Updates (October 25, 2026)](https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/)
- [CyberScoop: Experts temper emergency-level alarms over critical Brotli defect (October 26, 2026)](https://cyberscoop.com/brotli-critical-vulnerability-decompression-library-node2shell-broccoli2shell/)
- [OSV: GHSA-9v8h-qqgm-4m35, Brotli out-of-bounds write also affects the PyPI Brotli package (published October 22, 2026; modified October 24)](https://osv.dev/vulnerability/GHSA-9v8h-qqgm-4m35)