XBOW said on 13 October that it won $250,000 from Google’s Chrome bug bounty programme after using AI agents running OpenAI’s GPT-5.6 Sol to build an exploit. The exploit chained three previously unknown Chrome bugs; loading a web page was enough to run code outside Chrome’s sandbox on Windows, without a click or download. Google has fixed all three bugs, and XBOW says they were never used against Chrome users. The company estimated that before the fixes, the flaws exposed about one billion people using Chrome on Windows. XBOW called it the first full-chain Chrome award under rules Google introduced in April 2026.

Researcher Brendan Dolan-Gavitt and the agents built the awarded chain between 2 and 7 August, during Black Hat and DEF CON in Las Vegas. XBOW estimated the computing cost at about $40,000 based on usage logs. The six-day build followed months of work: CEO Oege de Moor set the challenge at a company meeting in Malta at the start of 2026, and four researchers—Dolan-Gavitt, Andrés Luksenberg, Baul Lee and Willem Pinckaers—took it on. Their first chain failed because Google already knew one bug, so they replaced it with a backup stage. The agents searched Chrome’s source code, tested ideas, built proofs of concept and drafted each stage; researchers selected targets, supplied context, challenged results and decided what to combine.

The chain crossed two sandboxes: a V8 Maglev compiler bug enabled reading and writing inside V8’s sandbox; an animated WebP decoder bug allowed one chosen write outside it; and a Crashpad bug turned that write into full code execution. Google’s Chrome 152 release notes credited Dolan-Gavitt for the Crashpad flaw, CVE-2026-78952, rated high. Fixes shipped in Chrome updates on 25 August and 3 September, though users must restart the browser for an update to take effect. Google also patched a separate V8 flaw in September that attackers were already using.

OpenAI released GPT-5.6 to everyone in July and paused a model over cyber risk in August. De Moor argues that restricting powerful models is the wrong question because XBOW used a publicly available model. He expects agents working alone could find each of the three bugs within a year. OpenAI cyber research head Clint Gibler said the company wants to help defenders find and fix critical vulnerabilities faster. Dolan-Gavitt warned that six days and $40,000 is little time or money when the payoff is a Chrome exploit chain.

XBOW said on 13 October that it won $250,000 from Google’s Chrome bug bounty programme after using AI agents running OpenAI’s GPT-5.6 Sol to build an exploit. The exploit chained three previously unknown Chrome bugs; loading a web page was enough to run code outside Chrome’s sandbox on Windows, without a click or download. Google has fixed all three bugs, and XBOW says they were never used against Chrome users. The company estimated that before the fixes, the flaws exposed about one billion people using Chrome on Windows. XBOW called it the first full-chain Chrome award under rules Google introduced in April 2026.

Researcher Brendan Dolan-Gavitt and the agents built the awarded chain between 2 and 7 August, during Black Hat and DEF CON in Las Vegas. XBOW estimated the computing cost at about $40,000 based on usage logs. The six-day build followed months of work: CEO Oege de Moor set the challenge at a company meeting in Malta at the start of 2026, and four researchers—Dolan-Gavitt, Andrés Luksenberg, Baul Lee and Willem Pinckaers—took it on. Their first chain failed because Google already knew one bug, so they replaced it with a backup stage. The agents searched Chrome’s source code, tested ideas, built proofs of concept and drafted each stage; researchers selected targets, supplied context, challenged results and decided what to combine.

The chain crossed two sandboxes: a V8 Maglev compiler bug enabled reading and writing inside V8’s sandbox; an animated WebP decoder bug allowed one chosen write outside it; and a Crashpad bug turned that write into full code execution. Google’s Chrome 152 release notes credited Dolan-Gavitt for the Crashpad flaw, CVE-2026-78952, rated high. Fixes shipped in Chrome updates on 25 August and 3 September, though users must restart the browser for an update to take effect. Google also patched a separate V8 flaw in September that attackers were already using.

OpenAI released GPT-5.6 to everyone in July and paused a model over cyber risk in August. De Moor argues that restricting powerful models is the wrong question because XBOW used a publicly available model. He expects agents working alone could find each of the three bugs within a year. OpenAI cyber research head Clint Gibler said the company wants to help defenders find and fix critical vulnerabilities faster. Dolan-Gavitt warned that six days and $40,000 is little time or money when the payoff is a Chrome exploit chain.