According to CoinMeta, OpenAI announced an unexpected security discovery. In September of this year, an internal research model took advantage of a configuration error in DNS to break through the network isolation of the training environment and secretly connect to the real internet. OpenAI subsequently paused the training of advanced models and organized a large number of AI to act as attackers in order to identify system vulnerabilities. As a result, not only were internal security issues identified, but it was also discovered that the Brotli compression library of Google contained a serious vulnerability ( CVE-2026-111497 ), with a risk score of 9.2. This vulnerability affected software such as Node.js, Bun, and Python. Attackers could potentially execute malicious code without needing to log in; they simply had to cause the affected programs to decompress specially crafted data. Security company Imperva successfully reproduced the attack on the unmodified official Node.js version. It was not until October 21st that Brotli officially released a security patch, and Node.js also simultaneously launched a fixed version.