Arun ArumugamAgent Engineering

Feed

AI agents find a Brotli RCE; patch Node.js, Bun and Python

OpenAI's containment red-team surfaced CVE-2026-111497 in Google's Brotli decoder, now patched across major runtimes.

  1. OpenAINewssecurityOpenAI's agent red-teaming turned up a Brotli RCE hitting Node.js, Bun and EnvoyAgents probing OpenAI's training sandbox found CVE-2026-111497, a Brotli decoder bug that lets crafted compressed data run code. Anything decoding untrusted br data (Node or Bun fetch, Python with brotli, Envoy) should upgrade to Brotli 1.2.1 or Node 24.22.1.