OpenAI found a remotely exploitable Brotli vulnerability, Claude Code 2.1.310 opens Monitor to Bedrock, Copilot counts third-party tool requests

While testing the isolation of its training environment, OpenAI found an unauthenticated remote code execution vulnerability in Brotli, the compression library bundled with Node.js, Bun and Envoy. Tracked as CVE-2026-111497 and now fixed, the discovery was not mentioned in its post the previous day. Among coding agents, Claude Code 2.1.310 opens the Monitor tool to Bedrock, Vertex and Foundry, the Gemini CLI nightly gains the ability to list its models in JSON, and Qwen Code moves to v0.26.1. Finally, GitHub’s Copilot metrics API now counts requests from third-party tools such as OpenCode, Claude Code and Codex.

OpenAI found an unauthenticated remote code execution vulnerability in Brotli, fixed in Node.js, Bun and Envoy

October 23 — On the evening of its post about securing the training environment for its frontier models, covered here yesterday, OpenAI adds information on X that was absent from the post. During that same simulated attack campaign (red teaming), the company found an unauthenticated remote code execution vulnerability in Brotli, a compression library integrated into many software projects. Malicious compressed data is enough, with no account creation required, and the attack works in both directions.

That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl —compressed”) could be taken over by a malicious server. — @OpenAI on X

The root cause had been fixed in Brotli’s source code back in February, without anyone recognizing it as a vulnerability, and no version had been released since. OpenAI notified Brotli and downstream projects such as Node.js; Brotli published new versions and CVE-2026-111497. According to Patch the Planet’s page on the vulnerability, the Node.js security advisory credits OpenAI’s Codex Security team with the report. Envoy and Istio are affected only if configured to decompress Brotli; the vulnerability can also crash a process or disclose memory, and the page lists no CVSS score.

Affected software	Fixed versions
Node.js	22.23.4, 24.22.1 and 26.12.1
Bun	1.4.4 (with Brotli 1.2.1)
Envoy Proxy	1.40.0, 1.39.3, 1.38.6 and 1.37.8
Istio	1.29.9 (end-of-life branch), 1.30.6 and 1.31.2
Google Brotli (upstream project)	1.0.10, 1.1.1 and 1.2.1

If an immediate update is not possible, the page recommends disabling Brotli decoding for untrusted data while keeping gzip or deflate: reject Content-Encoding: br requests before any decompression, disable automatic decompression in HTTP clients, and disable the Brotli filters in Envoy and Istio. Disabling Brotli compression for responses on a CDN is not enough. The CVE had already appeared here among the Node.js vulnerabilities targeted by Cognition’s plugin (October 22), then in Replit’s response (October 23), without OpenAI being identified as its discoverer.

🔗 Patch the Planet’s page on the Brotli vulnerability

Coding agents: Claude Code 2.1.310, Gemini CLI and Qwen Code 0.26.1

Three command-line coding agents release a version within twenty-four hours: support for third-party providers in Claude Code, agent control in Gemini CLI, and daemon and scheduled tasks in Qwen Code.

Claude Code 2.1.310 opens the Monitor tool to Bedrock, Vertex and Foundry and fixes 14 issues

October 23 — Claude Code 2.1.310 arrives on npm at 21:20 UTC, followed by a GitHub release at 23:39 UTC, with 26 entries including 14 fixes. The Monitor tool, which runs a command in the background and sends each line of output back to Claude so it can react to a log or file change, has been available since April: it now works on Amazon Bedrock, Vertex and Microsoft Foundry, as do monitors supplied by plugins (plugin monitors), and when telemetry or nonessential traffic is disabled. Behind certain gateways that reject the effort-2025-11-24 beta value or system messages during a conversation, Claude Code now retries without them, and compaction following an Prompt is too long error no longer retains excessive amounts of dense text (base64, SVG). On Windows, one fix addresses security: PreToolUse and PermissionRequest hooks allowed a tool call through when Git Bash was missing and the hook command consisted entirely of quoted strings. On Linux, /sandbox identifies the Ubuntu AppArmor restriction that prevents bubblewrap from starting, along with how to lift it. Permissions for cloud sessions and Remote Control become part of Enterprise custom roles, Claude Tag receives three fixes, and the TypeScript 0.3.310 and Python 0.2.174 Agent SDKs align with this release.

🔗 Claude Code 2.1.310 release notes

Gemini CLI: the October 24 nightly lists models in JSON and respects cancellation with Esc

October 24 — Published at 01:15 UTC, the October 24 v0.67.0 nightly includes five PRs merged the previous day. Its only new feature, gemini models (or the --list-models option), lists the models available for the current configuration with their identifier, name, description and context limits; with -o json, it returns a script-friendly array, without authentication logs on standard output, so it can be piped into jq. It addresses an issue opened on June 11. Two fixes concern agent control: canceling with Esc immediately after a batch of tools displayed Request cancelled, but the agent resumed and launched new shell commands (PR 29868); in an IDE opened on multiple roots or a parent folder, relative paths are now resolved against the active file’s workspace, whereas the CLI could previously write into a neighboring repository (PR 29838). Finally, gemini hooks migrate --from-claude converts Claude Code hook timeouts from seconds to milliseconds: a hook set to 30 seconds was being cut off after 30 milliseconds. The stable v0.65.0 and preview v0.66.0-preview.0 remain unchanged.

🔗 Gemini CLI v0.67.0-nightly.20261024 on GitHub

Qwen Code v0.26.1 retains the daemon token and gates scheduled tasks with a shell command

October 24 — Three days after v0.26.0, Qwen Code moves to stable v0.26.1 with 41 features, 63 fixes and a single breaking change, limited to the QQ Bot channel. On request, qwen daemon start --save-token saves the daemon’s access token in a file readable only by its owner, and a scheduled task can depend on a shell command executed outside the model, providing the basis for probes that monitor pull requests and a /autofix-pr command. The Managed Agent gains manual context compression and MCP server management without recreating sessions; official DeepSeek support moves to deepseek-flash.

🔗 Qwen Code v0.26.1 on GitHub

The Copilot usage metrics API counts requests from OpenCode, Claude Code, Codex and other third-party tools

October 23 — The GitHub Copilot usage metrics API now measures model requests sent through Copilot by tools outside the editor, such as OpenCode, Claude Code, Codex or Zed. These tools often send no editor telemetry, so their usage was missing from totals_by_ide; counting now happens on the server, in a new totals_by_client array in enterprise, organization and per-user reports, over 1 day and 28 days.

Field in `totals_by_client`	What it measures
`client`	The sending tool: opencode, claude_code, codex, zed, copilot_cli, vscode, jetbrains… (unrecognized tools under `other`)
`request_count`	Successful model requests
`session_count`	Distinct sessions
`token_usage`	Prompt and output tokens, with the average per request
`totals_by_model`	The same metrics by model, with the selection mode: `user_selected`, `auto` or `product_selected`

GitHub spells out the limitations itself: a prompt can trigger multiple model calls, so request_count cannot be compared with a prompt count; the client is identified on a best-effort basis through the integration identifier (integration ID) sent by the tool, without a verified identity; Copilot code review and the cloud agent report a model selected by the product. This measurement differs from tracking agent applications (agent apps), which counts tasks launched on GitHub by Claude or Codex. It is intended for owners and billing managers, or any role with the View Copilot Metrics permission, and builds on the October 22 addition of skill, agent and MCP server names. No usage figures are published.

🔗 Usage metrics API adds usage from tools like OpenCode

Briefs

GitHub

Copilot CLI 1.0.104-1 through -3 — Three prereleases, still without a stable 1.0.104; only -2 details its changes: the managed “fusion” model starts sessions on Auto with the fusionTier settings, and interactive or SDK Autopilot sessions wait for their background tasks instead of stopping at COPILOT_TASK_WAIT_TIMEOUT_SECONDS. 🔗 source
A single GitHub app in Teams — The GitHub notifications app becomes the GitHub app and integrates Copilot: mentioning @GitHub on a notification starts the investigation, fix and pull request. The old app will be renamed “GitHub (deprecated)” and then retired on November 16. 🔗 source
EMU accounts restored — From June 1 to 13, around 12,285 Enterprise Managed Users accounts deprovisioned through SCIM were deleted instead of suspended, including 76 that were still active, because of a new deprovisioning path; GitHub restored them in October, with no action required. 🔗 source
Public monitoring for secret scanning — Monitoring for an enterprise’s credentials exposed in public repositories gains alert sorting, continuous validity checks, a REST API and a webhook, still in public preview; closing an alert does not revoke the exposed credential. 🔗 source

Assistants at work

Docs Live on mobile — Catching up on October 21: Docs Live arrives in the Google Docs app on Android and iOS; users speak, even in a disorganized way, and Gemini builds a structured document drawing on Gmail, Drive, Chat and the web. Enabled by default, including for Business and Enterprise Standard and Plus, Google AI Pro and Ultra. 🔗 source
ChatGPT Enterprise and Edu Admin Console — Analytics are split between Usage and Insights, user surveys replace the Impact tab, and workspaces with a verified domain allow 7 days to migrate a personal ChatGPT workspace, a period administrators cannot change. 🔗 source

Models and infrastructure

MiniMax M3.1 Flash on Tenstorrent Cloud — Tenstorrent has been serving the model since the day its weights were released, in a testing environment (playground) or connected to an agent harness, on its Tensix chips; no pricing or throughput announced. 🔗 source
GLM 5.3 Flash on the Mistral API — Catching up on October 22: Mistral serves zai-glm-5-3-flash, a multimodal MoE with 320B parameters, including 18B active, and a 1M-token context, at 0.15 dollars per million input tokens (0.03 cached) and 0.50 for output; the third Z.ai model at Mistral. 🔗 source

Research

Beetle — Researchers from Cambridge, EleutherAI and Oxford publish 330 small models (285 bilingual, in English and one of 21 languages, and 45 monolingual) with checkpoints, data and code, trained on 100M, 2B and 24B tokens according to the post, to study second-language learning; repositories have no declared license. 🔗 source
VocabX — Catching up on October 21: by rebuilding the vocabulary of its Qwen3-4B-based Portuguese essay grader around the cost of each token, Dharma-AI reduces measured inference cost by 77 % and raises its quality score from 0.703 to 0.810; provisional figures, paper under review, no code published. 🔗 source

What this means

The chain from discovering a vulnerability to fixing it unfolded over four days in these pages: on October 21, OpenAI published a report on its coordination around PHP2Shell; on the 22nd, Cognition tasked an agent with fixing vulnerabilities in PHP, Node.js and GitLab; on the 23rd, Replit mitigated the Brotli vulnerability with firewall rules; and OpenAI now reveals that it discovered it. The Brotli case shows where the difficulty lies: the root cause had been fixed in the code since February, but no one had recognized it as a vulnerability, and no release included the fix. It had to be recognized, releases published, and then Node.js, Bun, Envoy, Istio and their users had to follow. A simulated attack campaign run to protect a training environment thus ends up fixing a library that ordinary HTTP servers and clients run.

Coding agents connect to other providers’ infrastructure. Claude Code runs Monitor on Amazon, Google and Microsoft, Gemini CLI imports Claude Code hooks with the correct time unit and exposes its models as JSON for scripts, and Qwen Code retains its daemon’s token on request. Today’s fixes mainly concern control over the agent: an Escape key that failed to stop the agent, relative paths that wrote to a neighboring repository, and Windows hooks that let a tool call through. These are less about missing features than safeguards that failed to hold.

Governance relies on measurement. Copilot also serves as a model provider for competing agents, and GitHub now tracks usage from OpenCode, Claude Code and Codex on the server side, model by model, along with the selection mode, a day after adding the names of skills, agents and MCP servers. Administrators can finally see which tools use their subscription, subject to the limitations GitHub itself documents regarding client identification. OpenAI is following the same path in the ChatGPT Enterprise Admin Console, reorganized around usage and adoption.