OpenAI says it found a remote-code-execution flaw in Brotli during red-teaming

OpenAI says that during a red-teaming exercise it found a vulnerability allowing unauthenticated remote code execution in Brotli, a widely deployed compression library. The company announced it on X, and says it has already disclosed the flaw to Brotli and to downstream projects such as Node.js.

The post describes Brotli as "included in many pieces of software such as Node.js, Bun, and Envoy." That is the part worth reading twice. This is not a bug in one application. It is a bug in a component that other applications carry around like a spare tire.

What OpenAI says the flaw allows

Per OpenAI, the flaw "could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account." No login, no account, no foothold needed first. Just compressed bytes.

The attack runs in both directions, according to the announcement. An unpatched server that accepts compressed input could be taken over by a malicious client. An unpatched client that accepts compressed input, such as curl --compressed, could be taken over by a malicious server. So the usual comfort of "we are only the client" does not apply here.

OpenAI says it disclosed the vulnerability to Brotli and other downstream projects such as Node.js, "which released or are currently releasing security updates." Brotli, the company says, cut new release versions and published a CVE. Details on the patch and mitigations are linked at patchtheplanet.org/brotli.

A fix that was not yet an update

The timeline is the oddest part. OpenAI says the root cause was "actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli."

A source fix is not the same as an update reaching users.

The post does not say which year that February was, how long the exercise ran, or what exactly was being red-teamed when the flaw turned up. "Red-teaming exercise" is the whole description of the method, and the announcement does not explain how much of the discovery process was automated.

Why embedded libraries make this slow

OpenAI spells out the cleanup problem itself: "Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software."

That is a chain of three steps. Brotli releases. Each downstream project integrates and ships. Then every operator actually installs the update. The first step is done, according to OpenAI. The second is in progress for some projects ("released or are currently releasing"). The third is a matter of every single deployment, and the announcement does not say how many remain unpatched.

For the record, the post drew 920 likes and 98,919 views on X. The number that matters is how many deployments remain unpatched. That one is not in the post.

The headline claim, remote code execution without authentication, rests on OpenAI's description for now.

What to watch

• Version information. The announcement gives no CVE identifier, no affected version ranges and no patched version numbers for Brotli, Node.js, Bun or Envoy.
• Downstream release timing. OpenAI says Node.js "released or are currently releasing" updates. Bun and Envoy are named as carriers of Brotli, but their update status is not in the post.
• Client-side exposure. Unpatched clients that accept compressed input can also be exposed; the supplied example is curl --compressed.
• Evidence of exploitation. Nothing in the announcement says whether the flaw was used in the wild before disclosure.

The practical instruction is short: read patchtheplanet.org/brotli, find where Brotli lives in your stack, and update. The February fix shows how a repaired bug can sit without a release while its significance goes unrecognized. The cost of that gap falls on whoever has not updated yet.