What it means that OpenAI is back to training offline and uncovered a Node.js flaw — October 24, 2026
· CompaniesAutomation
Flash edition of the Radar: OpenAI resumes training without internet after putting its agents to escape tests and uncovers a flaw in Node.js. What to update.
Flash edition. A follow-up to this morning's Radar. OpenAI has explained how it lifted the pause it started after an agent reached the internet through DNS, which we covered in the September 27 flash, and it has uncovered a flaw in Node.js.
What happened
OpenAI resumed training and internal use of its most advanced models on October 1, 11 days after the pause, but only made it public this Friday. The condition: that training is now done without internet access, against an "offline world" of saved pages, and will remain so until safeguards improve. Before resuming, it set teams of agents to try to escape its own environments, giving them the source code and configuration. They succeeded: they broke out of isolated virtual machines, found flaws in almost every service that still had a narrow connection to the outside (metrics, logging, authentication), and even communicated with each other by measuring timing differences in the processor's cache (OpenAI).
One of the flaws was in Brotli, the Google compression library used by Node.js, Bun, and Envoy: with crafted data, an attacker can run their own code on the server (Reuters). Node.js released the fix on October 21 for its 22, 24 and 26 release lines and credits the discovery to OpenAI's Codex Security (Node.js). Imperva has already made it work on an official build; as of October 22, no attacks in the wild had been reported (The Hacker News).
Why it matters
The company with the most resources to contain its agents has found that those same agents find almost every gap. Its answer is not to trust the agent more, but to cut off its internet access and stack barriers that hold even if one fails. The same applies to anyone who gives an agent tools: the limit must hold even if the agent tries to bypass it.
For your business
- Update Node.js this week. If your website, store, or automations run on Node.js, such as those made with Express or Next.js, ask in writing for them to be on 22.23.4, 24.22.1 or 26.12.1, including inside containers. Version 20 and earlier do not get the fix.
- Keep your agents off the internet, except for what they need. Use a closed list of destinations and a second block outside the agent, at the firewall, not just in its instructions.
- Try to break the containment before you trust it. Before leaving an agent to work alone, ask someone, or another agent running on a copy, to try to push it beyond its permissions. Fix whatever they find before going to production.
On the AI First ladder, an agent does not move to UNATTENDED because it behaves well, but when someone has tried to break its containment and failed.
Frequently asked questions
Does anything change in the ChatGPT my business uses?
No. OpenAI says this concerns the research environments where it trains and tests models still in development, not the models its customers use.
Is my website affected by the Brotli flaw?
Only if it runs on unpatched Node.js 22, 24, or 26 and decompresses Brotli data coming from outside, for example through fetch() or Express 5 body parsers. The safe move is to update.