Additional reporting confirms exploit details, billion-user impact, and AI model context
Following·Day 2·first covered 14 Oct 2026·2 sources
XBow Wins $250K Chrome Exploit Bounty With GPT-5.6 Sol in Six Days
The gist
A full-chain browser exploit that previously required months of specialist work was completed in six days for $40,000 in compute costs. The cost of finding critical vulnerabilities is falling for both attackers and defenders, as the author of one item put it.
The full picture
Security firm XBow built a full-chain Chrome exploit in six days using OpenAI's GPT-5.6 Sol and won Google's $250,000 bug bounty. The exploit chain turns ordinary JavaScript in a Chrome tab into code executing outside every sandbox by crossing two protective boundaries through three separate flaws. Google confirmed all three bugs, shipped fixes, and awarded the bounty. The compute cost for the six-day run was $40,000. XBow engineer Brendan Dolan-Gavitt ran GPT-5.6 Sol against Chrome's source code while human engineers guided targeting and assembled the chain. The exploit affects over a billion Chrome users on Windows and requires no user action beyond visiting a malicious site.
How it developed
XBow's GPT-5.6 Sol-assisted Chrome exploit and $250,000 bounty win reported
Sources
Rohan Paul Twitter
Related
- Split fromAI agent hacking incidents across labs
The daily email
Want this in your inbox?
I send one email each morning with the stories that moved. If you would rather just read here, that works too.
Subscribe free