IT之家 · 智能时代 · 10/14/2026, 16:43:00
XBOW Uses GPT-5.6 Sol to Breach Chrome Sandbox in Six Days for $250k Bounty
Security team XBOW leveraged OpenAI's GPT-5.6 Sol model alongside four human researchers to build a full-chain exploit for the Chrome browser in just six days, achieving complete system access. The findings were patched by Google, which awarded a $250,000 bounty, demonstrating how AI agents can drastically reduce the time required for complex code auditing and vulnerability discovery compared to traditional manual methods.
SOURCE COVERAGEFull Original Report
On October 14, it was reported that the security research team XBOW recently discovered and constructed a full-chain exploit for the Chrome browser, potentially affecting approximately 1 billion users worldwide. The relevant vulnerabilities have already been reported to Google and patched, with Google awarding the team a $250,000 bug bounty (Note from IT Home: equivalent to approximately 1.676 million RMB at current exchange rates).
XBOW stated that by leveraging models such as OpenAI's GPT-5.6 Sol and involving four researchers, they successfully breached Chrome's security and gained full system access in just six days. According to an industry insider, similar work performed entirely by humans would take approximately six months.
The team invested roughly $40,000 in computational costs (equivalent to approximately 268,000 RMB at current exchange rates) during their vulnerability research. AI handled tasks such as searching Chrome's source code, testing ideas, building proof-of-concept programs, and writing the initial versions of the exploits. Team members were responsible for defining the overall strategy, determining research directions, reviewing the agents' outputs, and adjusting the agents' actions based on initial test results.
XBOW urges all users to ensure their Chrome browser is updated to the latest version, noting that all three vulnerabilities discovered by the team have already been fixed by Google.