XBOW, a security company, claimed a $250,000 prize from Google's Chrome bug bounty programme on 13 October after constructing an exploit that linked three previously unknown Chrome flaws. The attack was built using AI agents powered by OpenAI's GPT-5.6 Sol. Simply visiting a webpage was sufficient to execute arbitrary code outside Chrome's sandbox on Windows machines, requiring neither user interaction nor file downloads.
According to XBOW, this marks the first full-chain Chrome award under the rules Google rolled out in April 2026. All three vulnerabilities have since been patched by Google, and XBOW confirms they were never exploited in the wild. The unpatched flaws posed a threat to approximately one billion Chrome users on Windows, the company estimates.
Six days and $40,000
Researcher Brendan Dolan-Gavitt and the AI agents developed the winning exploit between 2 and 7 August while attending Black Hat and DEF CON in Las Vegas. XBOW calculated the computational expense at roughly $40,000 based on its usage records. CEO Oege de Moor noted that the company deliberately selected a model accessible to the general public.
The rapid six-day completion came after extensive preliminary effort. De Moor introduced the challenge during a company gathering in Malta in early 2026. Four researchers—Dolan-Gavitt, Andrés Luksenberg, Baul Lee and Willem Pinckaers—accepted the task. Their initial attempt fell through when Google disclosed it was already aware of one of the bugs, prompting the team to substitute an alternative component.
The AI agents handled source code analysis, hypothesis testing, proof-of-concept development and initial drafting of each component. Human researchers identified the targets, offered supporting information, evaluated the outputs and determined how to integrate the pieces.
We did apply a fair bit of our own human expertise and judgment
Brendan Dolan-Gavitt
The acceleration compared to traditional methods was striking. Dolan-Gavitt observed that before large language models, assembling a complete Chrome exploit typically required four researchers working for six to nine months. XBOW's initial submission took two months, while the final award-winning version required just six days.
Three bugs, two sandboxes
Chrome employs dual containment: JavaScript runs within a sandbox in the V8 engine, and each webpage operates in a separate operating system-level sandbox. The exploit breached both layers. A flaw in V8's Maglev compiler granted read-write capabilities within the V8 sandbox. A separate vulnerability in the animated WebP image decoder enabled a controlled write operation to escape that sandbox.
The third vulnerability existed in Crashpad, Chrome's crash reporting system, which operates outside the sandbox. This flaw converted a single write operation into complete code execution. Chrome 152's release notes acknowledge Dolan-Gavitt of XBOW for discovering the Crashpad vulnerability, designated CVE-2026-78952 and classified as high severity.
Google deployed fixes through Chrome updates on 25 August and 3 September, according to The Hacker News. While Chrome applies updates automatically, the fixes only activate after a browser restart. In September, Google also released a patch for a separate V8 vulnerability that was already being exploited in active attacks.
A public model
OpenAI made GPT-5.6 available to the public in July. The following month, OpenAI paused a different model citing cybersecurity concerns. De Moor contends that limiting access to advanced models misses the point, since the model XBOW employed is already widely available. He predicts that autonomous agents could discover each of the three individual bugs within a year.
We want to help more defenders find and fix critical vulnerabilities faster
Clint Gibler, head of cyber research at OpenAI
Dolan-Gavitt concluded his technical analysis with a stark message for the security community.
Six days and $40k is not a lot of time or money when the payoff is a Chrome chain! Defend accordingly.
Brendan Dolan-Gavitt
Source: The Next Web
