OpenAI resumes frontier AI training after security overhaul, discloses flaw in widely used software

OpenAI has resumed training its most advanced AI models, following a security overhaul and the decision to restrict internet access. This comes after one of its research models inadvertently gained limited internet access in September. The company discovered a flaw in Brotli, a commonly utilized data compression tool, during a test of its defenses.

Attackers could exploit this vulnerability by sending malicious data, enabling them to execute their own code on affected systems, including those employing popular web software like Node.js, Bun, and Envoy. The flaw's root cause was rectified in February, although no new version was released at the time. OpenAI disclosed the vulnerability after Brotli updated versions and made a public record of the issue.

Additionally, AI safety evaluators METR and Redwood Research uncovered multiple new vulnerabilities in OpenAI's internal system during a pilot review earlier this year. However, OpenAI assured both organizations that all vulnerabilities affecting its production safeguards had been patched.