Security firm XBOW collected a $250,000 reward from Google after its researchers used OpenAI's public GPT-5.6 Sol model to build a full Chrome exploit chain in six days.
Key Points:
- XBOW researchers used AI agents running OpenAI's GPT-5.6 Sol to chain three Chrome bugs into a full Windows takeover.
- Google paid its top $250,000 full-chain bounty, and all three bugs are now patched.
- The six-day sprint cost about $40,000 in compute, and XBOW warns that the cost of attacks is falling fast.
XBOW Chrome Exploit
XBOW disclosed the work on Oct. 13, saying a single crafted web page could have broken through both of Chrome's sandboxes and taken over a Windows computer without any click or download.
The chain linked three bugs in Chrome's V8 JavaScript engine, its animated WebP image decoder and Crashpad, a crash handler that runs outside the browser's sandbox.
The researchers built the winning chain between Aug. 2 and Aug. 7, while attending the Black Hat and DEF CON security conferences in Las Vegas. The six-day push cost roughly $40,000 in AI compute, by XBOW's count. An earlier version failed because Google already knew about one of its bugs.
Google paid its top full-chain bounty about a month after the submission, the first such award under program rules it revised in April. XBOW estimated the flaws exposed about 1 billion Chrome users on Windows, though it said none was ever used in real attacks and that Google has patched all three.
Also Read: France Could Tax Stablecoin Swaps At 31.4%, Chainalysis Warns Of Offshore Exodus
Dolan-Gavitt Warns Defenders
Brendan Dolan-Gavitt, the XBOW researcher who built the final chain with AI agents, said a team of four once needed six to nine months to produce a Chrome full chain. Google's release notes credit him for two of the three bugs. The sprint itself relied on months of earlier work, including a first full chain that took two months to complete.
"Six days and $40k is not a lot of time or money when the payoff is a Chrome chain!" Dolan-Gavitt wrote. His advice to defenders was blunt: "Defend accordingly."
Founder Oege de Moor, who set the challenge at a January staff meeting in Malta, said the AI searched source code, tested ideas and drafted the exploit while humans chose targets and checked its work.
He expects agents to find each of the three bugs on their own within a year, and he dismissed calls to restrict powerful models because the one XBOW used is already public. "None of this is cause for panic, but it is cause for urgency," he wrote.
The award follows a July experiment in which Hacktron researchers watched GPT-5.6 Sol, in its Ultra configuration, construct a working Chrome exploit chain from public V8 security patches, launching a calculator app as proof. That run cost roughly $1,597 but targeted bugs Google had already fixed.
Read Next: MNX Opens Pre-IPO Bets On OpenAI And Anthropic Valuations, No Shares Required
