AI security company XBOW announced on October 13 that one of its researchers, working with OpenAI's GPT-5.6 Sol model, built a complete Chrome exploit chain in six days and collected a $250,000 reward from Google. When a user opens a web page, the attack code can break out of the browser's renderer sandbox and execute at the system level.
According to XBOW and several security outlets, this is the first full-chain reward paid out under the 2026 rules of Chrome's Vulnerability Reward Program, and the first time one has gone to a team whose main workforce is an automated platform.
How the three bugs fit together
Chrome's defenses are layered, and a single vulnerability can usually get through only one layer. XBOW's chain used three:
- A V8 bug: it gives control over memory inside the JavaScript engine, but the attacker is still trapped in V8's own sandbox.
- An animated WebP decoder bug (disclosed by XBOW as CVE-2026-85045): it is used to escape the V8 sandbox and perform one precise write to native memory.
- A Crashpad bug (CVE-2026-78952): Crashpad is Chrome's crash-reporting component and runs outside the sandbox, so compromising it yields full code execution.
The demo ran on a signed Chrome Beta build: the moment the page loaded, the system calculator popped open. XBOW says the bugs were reported through Google's official channels and fixed after Google reproduced them. The public materials do not say which Chrome version carries the fix, and Google has not issued a separate statement.
What the humans and the models each did
The chain was not produced by the model running on its own. XBOW describes the division of labor like this: the agents read through source code, proposed and tested hypotheses, and wrote proof-of-concept code, while the human researcher picked the target components, supplied context, decided which bugs to combine, and finally assembled the working exploit chain.
XBOW CEO Oege de Moor said on social media that no specialized cybersecurity model was involved; the team used the publicly available GPT-5.6 Sol. That is the company's own account and cannot currently be verified with Google. He launched the challenge to extend XBOW's business from web application penetration testing into desktop software, servers and connected devices.
Doing the math
XBOW estimates the API bill for this effort at about $40,000, a figure that excludes researcher salaries and the platform's own development costs. Against a $250,000 payout, model usage alone returned more than six times its cost.
A more useful comparison comes from another set of numbers. In September, security firm Hacktron ran an experiment in which several models tried to reproduce exploit chains from Chrome's already public security patches; getting a model to complete one full chain cost about $1,597 in API calls. The conditions are very different: Hacktron worked backward from known patches, while XBOW hunted for undisclosed bugs, which is far harder and cost more than twenty times as much.
Put side by side, the two figures show the cost structure of vulnerability research shifting. A Chrome full chain used to take top researchers weeks or months. Now one person and a group of agents did it in six days, with a bill in the tens of thousands of dollars. For a vendor like Google, bounties exist to compete with the vulnerability black market for talent; if the marginal cost of finding bugs keeps falling, the pricing logic of bounties will sooner or later need to be recalculated.
Questions still open
XBOW's announcement and the secondary reports differ in some details. One report says the chain ultimately obtained Windows system privileges, which other sources do not mention. How much of the work was done by the agents and how much by the researcher is likewise known only from XBOW's account. Whether Google credits the finding in Chrome's release notes and names the specific fixed version is what can be checked next.
Sources: XBOW official announcement, Runtime Wire, CocoLoop, Cybersecurity News. The bug composition, API costs and reward amount follow XBOW's disclosures and have not been independently confirmed by Google.