Security Firm XBOW Used GPT-5.6 Sol for $250,000 Chrome Exploit

A full-chain exploit for Google Chrome, the kind of attack that takes a browser from a web page to control of the computer underneath it, now costs about $40,000 of AI compute and six days of work. Security firm XBOW disclosed on October 13 that its researchers, directing AI agents that ran OpenAI's publicly available GPT-5.6 Sol, built a working Windows exploit from three Chrome bugs between August 2 and August 7, and that Google paid $250,000 for it, the first full-chain reward under rules Google introduced in April.

XBOW turned three Chrome bugs into one exploit in six days

Chrome is built in layers so that a single bug rarely matters. JavaScript runs inside the V8 engine, most of V8's memory sits inside its own 4 GiB sandbox, and the whole renderer runs inside an operating-system sandbox that keeps a hostile page away from the user's files. A full chain needs a separate bug for each wall, which is why Google pays the most for them and why they have historically come from a small number of elite researchers working for months.

The first bug, in V8's Maglev optimizing compiler, gave read and write access across the V8 memory cage. The second, in the decoder Chrome uses for animated WebP images, let the attacker swap image bytes after Chrome had checked them, producing one chosen write to native memory outside the cage. The third sat in Crashpad, Chrome's crash reporter, which runs outside the sandbox and turned that foothold into full code execution. In its technical write-up, XBOW notes that all three bugs came down to changing something the code assumed could not change, the kind of hidden invariant it says language models are well suited to find.

The exploit cost less than a sixth of the bounty it earned

Bug bounties are priced on an assumption about labor. Google sets its full-chain award high because finding three chained bugs used to absorb specialists for months, and that scarcity also protected users, since few people could build such chains and those who could were expensive to hire. XBOW's numbers break that assumption. At roughly $40,000 in API charges, the reward paid back more than six times the machine cost, and the six-day timeline is shorter than the gap many organizations leave between a Chrome release and installing it.

Source: XBOW Labs and XBOW blog, October 13, 2026. Table: Santage.

The detail that matters most for defenders is the model. XBOW used the same GPT-5.6 Sol that any paying API customer can reach, which puts the capability within reach of any well-funded team. It also fits a run of findings this autumn, from the GLM-5.3 open-weights exploit chain Anthropic documented to the UK AI Security Institute's tests of GPT-6 Astra on supply-chain attacks, that point the same way.

“We deliberately picked a model that is available to anyone, not a specialized security model or one with restricted access.”

Oege de Moor, founder and CEO, XBOW, XBOW blog, October 13, 2026

Human researchers still steered the chain, and XBOW expects that to change

XBOW describes the work as a partnership. Its AI agents searched Chrome's source code, tested hypotheses, built proofs of concept and drafted exploit stages, while researchers chose targets, supplied context, challenged results and decided which components to join. Four researchers took on the project, and the awarded chain was built by Brendan Dolan-Gavitt with the agents during Black Hat week in Las Vegas. XBOW also split the exploit into swappable stages with backups, a human design call that rescued the project when Google said it already knew about a bug in the first version.

That human role is the remaining constraint, and XBOW expects it to shrink. Chief executive Oege de Moor wrote that within a year each of the three bugs could be found by agents working on their own, and he dismissed calls to restrict model access as the wrong question because the model XBOW used is already public. Frontier labs have started to gate their most cyber-capable systems behind verified-access programs, but XBOW's chain shows that a general-purpose API already carries enough capability for a working browser exploit.

Browser makers and enterprises will both need faster patch cycles

The first effect will land on vendors. XBOW's first chain died because Google had already found one of its bugs internally, a sign that Google is pointing the same kind of models at its own code and that collisions between researchers will become routine. If a firm can earn six times its compute bill per full chain, more firms will run the same play against Chrome, Safari, Edge and the long tail of software that has never attracted elite attention, and bug volume will rise faster than triage teams can grow. Google can absorb that. Smaller vendors with modest bounty budgets and thin security staff will find it much harder.

The second effect lands on every company running browsers. Six days from start to exploit compresses the safe window for delaying updates, and XBOW's own advice to users is to relaunch Chrome whenever an update is waiting. The same economics are available to attackers who skip the bounty program. XBOW's chain was reported, paid and patched, and the method that produced it is now documented and runs on a model that is sold by the token.