Six Days, $40,000, One Public AI Model: XBOW Says It Built a Chrome-to-Windows Exploit Chain

XBOW says its researchers used AI agents built on OpenAI’s publicly available GPT-5.6 Sol model to develop a three-vulnerability exploit chain that broke out of Chrome and executed code on Windows. The company says the work took six days and roughly $40,000 in compute. The Hacker News reports a similar account: a crafted web page could trigger the chain and run code outside Chrome on Windows.

According to XBOW Labs, the chain combined flaws in V8, animated WebP processing, and Crashpad, Chrome’s crash-reporting component. XBOW also says human security experts directed the agents’ campaigns and evaluated their output throughout. That qualification shapes the whole story. The account supports AI-assisted exploit research under expert supervision, not a model that independently found, built, and weaponized a browser escape on its own.

On the money: XBOW says Google fixed all three vulnerabilities and paid a $250,000 bounty, and The Hacker News reports that Google confirmed the chain and paid the program’s top reward for a full chain. Google’s published reward rules do say a full-chain exploit from web content against an active Chrome release can earn up to $250,000, so the figure is plausible. But those rules don’t identify XBOW’s submission or describe the bugs. The material available here includes no CVE identifiers, Chromium issue links, patch commits, Google security bulletin, affected Chrome versions, or direct Google statement naming XBOW. The payout rests on XBOW’s and The Hacker News’s accounts, not on a Google document.

The real issue is speed, not proven autonomy. A browser-to-operating-system chain normally takes vulnerability discovery, exploit engineering, sandbox-escape work, and testing against real builds. XBOW says its expert-directed agents compressed enough of that to produce a three-bug chain in under a week. But the evidence doesn’t show that advanced exploitation is now cheap, routine, or autonomous. $40,000 is a substantial spend, and the account doesn’t disclose failed research paths, total human engineering time, prior tooling, the researchers’ experience, or how much existing exploit knowledge fed into the result.

Also treat one claim with caution: XBOW’s reference to the chain affecting “a billion users” isn’t substantiated. Nothing supplied establishes how many users were on an affected configuration, how long exposure lasted, or any use in the wild.

Bottom line: If XBOW’s account holds, it’s a serious data point: AI doesn’t have to replace exploit researchers to change the defensive picture, because cutting the time experienced teams need to chain bugs together can shrink the gap between a flaw being findable and an exploit being practical. For Chrome users and defenders, the advice is the familiar one: keep auto-updates on and patch quickly. What the record doesn’t yet show is a repeatable benchmark for fully autonomous vulnerability research, or any sign the chain was used outside responsible disclosure.