A browser exploit chain that used to take elite researchers months just came together in six days. The tab for the AI that helped build it came to around $40,000.
Autonomous offensive security company XBOW used OpenAI’s GPT-5.6 Sol model, working alongside human researchers, to find and exploit three previously unknown vulnerabilities in Google Chrome. Google paid out its maximum $250,000 bounty for the work. That was the first full-chain bounty awarded in 2026, and only the second in the history of the program.
Three bugs, one chain, six days
The campaign ran from August 2 to August 7, 2026. XBOW made it public on October 13, 2026.
The timing had a certain flair. The team did the work during the Black Hat and DEF CON security conferences in Las Vegas.
The chain stitched together three separate flaws. The first was a bug in the Maglev compiler inside V8, Chrome’s JavaScript engine. The second was a flaw in an animated WebP image decoder, tracked as CVE-2026-85045. The third was a memory safety issue in Crashpad.
XBOW’s chain got through the renderer sandbox and the V8 sandbox on Windows. The result: JavaScript running in an ordinary browser tab could lead to unsandboxed code execution on the underlying Windows system.
The flaws potentially affected approximately 1 billion Chrome users on Windows. Google has since patched all three bugs.
The price of a full chain
Google confirmed the findings and paid the reward about a month after XBOW submitted them. The $250,000 figure is the top payout under revised Chrome Vulnerability Reward Program rules that Google announced in April 2026.
XBOW reported compute costs of around $40,000 in API fees for the six-day effort. The model involved, GPT-5.6 Sol, is publicly available — not a secret lab tool.
Humans still in the loop
XBOW CEO Oege de Moor and researcher Brendan Dolan-Gavitt led the effort, directing AI agents through the campaign. This was the company’s second attempt at a full-chain submission.
Full-chain exploits of this kind traditionally took months. XBOW did it in under a week.
Why the timeline is the real story
Bug bounties exist because companies would rather pay researchers than let criminals find flaws first. XBOW’s result chips away at that assumption. If a small team with an off-the-shelf model can go from zero to a sandbox escape in six days, the window between a bug existing and a bug being weaponized gets much narrower.
For Google, the outcome here was the good version of events. The bugs went to the vendor, got patched, and got paid for.
The same publicly available model is accessible to attackers with very different plans. A $40,000 compute bill is pocket change for a well-funded criminal operation or a state-backed group.
What this means for defenders and the bounty market
Google’s top full-chain reward has now been paid out only twice in the program’s history. If AI dramatically lowers the cost of producing these chains, submissions could become more frequent, testing how programs price their rewards and how quickly their triage teams can verify complex findings.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.