OpenAI's 2026 red-teaming agents found a critical unauthenticated remote code execution flaw in Google's Brotli compression library, tracked as CVE-2026-111497