OpenAI's red-team agents went looking for holes in the lab and found one in Brotli
On Friday OpenAI explained why its frontier training now runs with no internet access, and how it pointed agent red teams at its own containment. A few hours later it added a footnote that matters more than the post.
During that red-teaming exercise, OpenAI said, the agents "also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy." In plain terms, an unpatched client that accepts compressed input could be taken over by a malicious server. Brotli shipped fixed releases on October 21, and the Node.js October security releases followed. Source: https://x.com/OpenAI/status/2113766354386084338 Fixed releases: https://github.com/google/brotli/releases
The detail that should worry every maintainer: the root cause "was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release." So the fix sat in the repo for eight months while every downstream project kept shipping the vulnerable release. A human reviewer saw a bug fix. An agent saw an exploit path. Security researchers have since traced the same decoders into Python HTTP libraries, so the blast radius is wider than the three names in the post.
Sam Altman put the general version bluntly at Stanford GSB, as quoted by Gizmodo: "I no longer think we're going to be able to just patch all the bugs," and defense will have to switch to "using the same technology for a new kind of defense shield." https://gizmodo.com/sam-altman-i-no-longer-think-were-gonna-be-able-to-just-patch-all-the-bugs-2000829947
That's the real lesson of the week. Agents built to attack a lab's own sandbox are, by construction, good at finding holes in the open-source stack underneath everyone. The patch-and-release cadence of volunteer-maintained libraries was designed for human-speed discovery, and it's now the slowest part of the loop.
← Back to all articles
During that red-teaming exercise, OpenAI said, the agents "also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy." In plain terms, an unpatched client that accepts compressed input could be taken over by a malicious server. Brotli shipped fixed releases on October 21, and the Node.js October security releases followed. Source: https://x.com/OpenAI/status/2113766354386084338 Fixed releases: https://github.com/google/brotli/releases
The detail that should worry every maintainer: the root cause "was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release." So the fix sat in the repo for eight months while every downstream project kept shipping the vulnerable release. A human reviewer saw a bug fix. An agent saw an exploit path. Security researchers have since traced the same decoders into Python HTTP libraries, so the blast radius is wider than the three names in the post.
Sam Altman put the general version bluntly at Stanford GSB, as quoted by Gizmodo: "I no longer think we're going to be able to just patch all the bugs," and defense will have to switch to "using the same technology for a new kind of defense shield." https://gizmodo.com/sam-altman-i-no-longer-think-were-gonna-be-able-to-just-patch-all-the-bugs-2000829947
That's the real lesson of the week. Agents built to attack a lab's own sandbox are, by construction, good at finding holes in the open-source stack underneath everyone. The patch-and-release cadence of volunteer-maintained libraries was designed for human-speed discovery, and it's now the slowest part of the loop.
Comments