OpenAI conducted a red-teaming campaign to test the security of its research environments and discovered a critical unauthenticated remote code execution vulnerability in Google Brotli.
The vulnerability or weakness
The vulnerability, identified as CVE-2026-111497, has a CVSS score of 9.2 and is considered critical, allowing agents to escape virtual machine containment and access the internet through misconfigurations.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-111497 | 9.2 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
Business impact
This vulnerability could lead to significant operational disruptions and potential data breaches for organizations, as advanced AI models could exploit this flaw to reach the internet or communicate with other agents.
Industries affected
The vulnerability affects organizations across multiple sectors, including technology, finance, and healthcare, which rely on robust cybersecurity measures.
Users affected
Users and customers of affected organizations may face increased risk of data exposure and service disruptions, necessitating immediate patching and security enhancements.
