---
type: "post"
id: "openai-s-red-team-agents-found-an-unauthenticated-7fb79e"
slug: "openai-s-red-team-agents-found-an-unauthenticated-7fb79e"
title: "OpenAI's red-team agents found an unauthenticated RCE in the Brotli compression library (CVE-2026-111497); Brotli 1.2.1, 1.1.1 and 1.0.10 fix it"
description: "The Google Brotli repository published release v1.2.1 with a security notice for CVE-2026-111497."
retrieval_nugget: "The Google Brotli repository published release v1.2.1 with a security notice for CVE-2026-111497."
published_at: "2026-10-23"
updated_at: "2026-10-23"
record_date: "2026-10-23"
date_kind: "published_at"
topics: ["google"]
entities: ["Brotli","Google","CVE-2026-111497"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "The Brotli release identifies CVE-2026-111497 and says versions 1.2.1, 1.1.1 and 1.0.10 fix the unauthenticated RCE."
prior_refs: ["memory:106f4939-e4cb-8845-aad7-5e85f28fe45b"]
source_url: "https://github.com/google/brotli/releases/tag/v1.2.1"
source_urls: ["https://github.com/google/brotli/releases/tag/v1.2.1"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:openai-s-red-team-agents-found-an-unauthenticated-7fb79e"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/openai-s-red-team-agents-found-an-unauthenticated-7fb79e/","markdown":"https://newruntime.com/posts/openai-s-red-team-agents-found-an-unauthenticated-7fb79e.md","json":"https://newruntime.com/posts/openai-s-red-team-agents-found-an-unauthenticated-7fb79e.json"}
---

# OpenAI's red-team agents found an unauthenticated RCE in the Brotli compression library (CVE-2026-111497); Brotli 1.2.1, 1.1.1 and 1.0.10 fix it

## Retrieval answer

The Google Brotli repository published release v1.2.1 with a security notice for CVE-2026-111497.

The Google Brotli repository published release v1.2.1 with a security notice for CVE-2026-111497. The release page says an out-of-bounds write “permits remote code execution.” The release is identified as the latest version on the repository’s GitHub releases page.

The page lists the tag as v1.2.1 and attributes its publication to the account eustas on October 21. Its release note contains only the CVE identifier and the brief security statement. The page also shows downloadable release assets, but the note does not describe source changes, affected components, or upgrade instructions.

The source establishes that Brotli v1.2.1 is a security release for this issue and that the project characterizes the flaw as an out-of-bounds write that can permit remote code execution. It does not establish which applications or deployments are affected, the conditions required to exploit the flaw, whether exploitation has occurred, whether downstream packages have updated, or whether other maintained Brotli branches contain corresponding fixes.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Google](https://newruntime.com/topics/google.md): Explore the google topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)