A chain of vulnerabilities in Google’s Chrome browser could have enabled researchers to take control of one billion Windows machines worldwide — and it cost them just $40,000 in AI compute time to discover it.
Researchers at Xbow USA worked for six days on developing the exploit, which earned them a $250,000 bug bounty from Google, the first under the new 2026 rules.
They chose OpenAI’s GPT-5.6 Sol for the task to demonstrate what’s possible with a publicly available model rather than a specialist security implementation. They used it to search Chrome’s source code, test ideas, and build proofs of concept, while they set the strategy, chose where to look, and checked its work.
They successfully chained together a vulnerability to escape first from the sandbox containing the V8 JavaScript engine and then from Chrome’s operating-system process sandbox, launching a Windows app from within a malicious web page.
Xbow presented its findings to Google, which fixed the flaws. The researchers set out all the details as to how the exploit was developed in a blog.