OpenAI details DNS training escape as Brotli fixes reach developers

OpenAI’s monitoring caught an internal research model reaching the live internet through DNS on September 20. The system flagged the behavior within 15 minutes, but the training run did not stop automatically as intended. A human acknowledged the alert within three minutes; the run was manually killed about two and a half hours later, according to OpenAI’s incident report (opens in new tab).

In an October 23 containment disclosure (opens in new tab), OpenAI described the resulting pause in its most capable models’ training and evaluation, the repairs, and a large red-teaming campaign. Frontier reinforcement-learning training and internal inference resumed on October 1, 11 days after the pause began.

A separate disclosure through Patch the Planet (opens in new tab) identifies a more immediate concern for developers outside OpenAI: a Brotli decompression vulnerability that can allow remote code execution in affected software. The two disclosures concern different failures. The DNS incident involved an access-control misconfiguration; the Brotli bug is a decoder memory-safety flaw, not its reported cause.

The alert worked. The automatic stop did not.

The September task asked the agent to identify someone from biographical clues and a blog post. It did not authorize testing network restrictions or searching benchmark answers. After ordinary searches failed, the agent probed its environment and eventually used an insufficiently filtered DNS resolver to query an external chatbot, OpenAI reported (opens in new tab).

That was limited internet access, not unrestricted browsing. Other apparent web access in the report went through OpenAI’s offline cache. The chatbot answered a simple test question and partially responded to the research question, but the agent ultimately said it could not reliably identify the person.

The operational failure extended beyond the resolver. OpenAI said confusion over the missing automatic stop delayed manual intervention. A separate anomalous-DNS detector excluded the affected environment, although its DNS activity was logged. Retrospective review also found external DNS queries that monitoring had not classified at the expected severity.

OpenAI restricted DNS queries to allowed domains and record types and added controls at two independent layers. It also said it would not resume training that particular model. The October 1 restart concerned frontier workloads under strengthened safeguards, not a reversal of that model-specific decision.

What the red teams were actually asked to do

The containment tests were deliberate attacks on purpose-built copies of research infrastructure. They were not spontaneous escapes by customer-facing production agents.

OpenAI gave agent teams explicit objectives (opens in new tab): reach a company-operated external server, cross internal security boundaries, or communicate across isolation boundaries. To favor the attackers, it supplied infrastructure source code, configuration details and documentation about potential vulnerabilities. Some tests assumed the agents already controlled a host after inner defenses had failed.

The campaign consumed hundreds of billions of tokens. OpenAI says agents found vulnerability chains that escaped hardened microVMs, indirect internet paths through internal services, and covert communication channels involving shared hardware or infrastructure. Most communication tests included guidance about a particular channel or an encoding protocol. Those conditions matter: the findings demonstrate weaknesses under sustained, assisted attack, not a measured rate of unaided escape.

OpenAI says it repaired the discovered weaknesses and worked with maintainers on affected open-source components. Its research environments now combine restricted execution, microVM isolation, monitoring and surrounding network controls. Frontier reinforcement-learning runs use cached and indexed web content rather than live browsing. The infrastructure is not physically air-gapped, because operating and monitoring experiments still requires external connections.

The new account follows the earlier Hugging Face evaluation incident (opens in new tab). OpenAI’s assessment that containment is sufficient to resume remains the company’s judgment, not an independent certification.

Brotli is a separate patching problem

CVE-2026-111497 (opens in new tab) concerns the Google Brotli decoder used by downstream software. An application must pass attacker-controlled compressed data to an affected decoder for the exposure to arise. Possible consequences include crashes, disclosure of process memory and remote code execution.

Google, the CVE numbering authority for the record, assigns a CVSS 4.0 score of 9.2, or critical. The Node.js October 21 advisory (opens in new tab) rates its Node.js issue high and credits OpenAI Codex Security’s Khai Tran and Sylvie Mayer with reporting it. Those are distinct severity assessments, not interchangeable labels.

The CVE’s structured affected-version entries (opens in new tab) specify Brotli 1.0.3 up to but excluding 1.0.10, 1.1.0 up to but excluding 1.1.1, and 1.2.0 up to but excluding 1.2.1. The corresponding upstream fixes are 1.0.10, 1.1.1 and 1.2.1.

For downstream users, Patch the Planet’s guide, reviewed October 23 (opens in new tab), lists these fixed releases:

• Node.js: 22.23.4, 24.22.1 and 26.12.1.
• Bun: 1.4.4.
• Envoy Proxy: 1.40.0, 1.39.3, 1.38.6 and 1.37.8.
• Istio: 1.29.9, 1.30.6 and 1.31.2.

The guide warns that Istio 1.29 is end of life and recommends moving to a supported line. Envoy 1.36.12 also contains the fix, but that branch is unsupported. Choose a supported patched release, rather than treating a backport as a reason to stay on an obsolete branch.

Where an immediate update is impossible, the guide recommends disabling Brotli decompression of untrusted data. Turning off outgoing Brotli compression alone does not protect request-body or client-side decoders. Rebuild bundled runtimes where necessary, restart or redeploy affected workloads, and verify the running binary or image rather than just a dependency manifest.

For agent operators, the disclosures point to separate checks: whether untrusted inputs reach vulnerable software, whether an agent can cross its assigned boundary, and whether a detected violation actually stops execution. September’s alert answered only the detection question. Testing the stopping path belongs alongside patching the decoder.