Today for AI
HOT RADAR
agentHEAT 23.8°

AI CLUSTERED EVENT · 10/14/2026

XBOW Agent Uses GPT-5.6 Sol to Build Chrome Exploit Chain in Six Days, Earning $250K Bug Bounty

3 reports archived3 independent sourcesupdated 10/14/2026, 16:43:00
Synthesis & Latest Updates
3 Sources Cross-Validated

AI security firm XBOW utilized an autonomous agent powered by OpenAI's GPT-5.6 Sol model to construct a full-chain exploit for the Chrome browser in just six days, with a compute cost of approximately $40,000. This achievement earned the first $250,000 full-chain bounty under Google's new 2026 VRP rules, marking a two-order-of-magnitude speedup compared to traditional human teams that typically require 6-9 months.

Cross-verified reports indicate the attack chain combined three independent vulnerabilities: bugs in the V8 compiler, the animated WebP decoder, and Crashpad memory safety. The GPT-5.6 agent autonomously handled code searching, hypothesis testing, and initial exploit drafting, while four human researchers focused on strategic decision-making and context supply. This 'human-in-the-loop' approach significantly compressed the time required for complex code auditing.

This event profoundly impacts the cybersecurity ecosystem, forcing defenders to reassess the effectiveness of existing security boundaries. Google has confirmed patching the vulnerabilities and urged users to update Chrome immediately. The case validates the commercial value of AI-assisted advanced vulnerability discovery, signaling a shift towards AI agents as core efficiency engines in cyber offense and defense, challenging traditional manpower-intensive research paradigms.

LATEST/Google has officially patched the three critical vulnerabilities discovered by the XBOW agent and paid the $250,000 bounty, urging all Chrome users to update immediately. This event solidifies AI's role in advanced vulnerability discovery, likely prompting more security firms to accelerate the deployment of similar autonomous agent systems.

HEAT TRENDHourly heat curve

34 fully observed hours
Now
23.8
Peak
37.917:00
24h change
-16%

The line compares only sources observed throughout; gap hours are interpolated to keep the trend continuous.

TIMELINECoverage timeline

Total 3 reports · Latest first
  1. IT之家 · 智能时代T2·84 pts
    • The XBOW team used the GPT-5.6 Sol model to search source code, test ideas, and write initial exploit code, while humans handled strategy and verification.
    • The entire attack chain construction took only 6 days with ~$40k compute cost, whereas equivalent manual work was estimated to take about 6 months.
    • Google has patched the three vulnerabilities and paid a $250,000 bounty, urging users to update Chrome immediately to mitigate risks.
  2. Rohan Paul (@rohanpaul_ai)T2·86 pts
    • GPT-5.6 agent autonomously executed the full pipeline from code analysis to exploit chain construction, with humans handling only strategic decisions and context
    • The complete Chrome double-sandbox bypass earned Google's first $250,000 full-chain bounty, validating the commercial value of AI-assisted advanced vulnerability discovery
    • Six-day timeline and $40,000 compute cost are far below months of specialist labor, marking an efficiency inflection point for AI security research
  3. Hacker News AIT2·88 pts
    • XBOW agents completed a Chrome full-chain exploit in 6 days, vastly outperforming the typical 6-9 month timeline for human teams.
    • The chain combined bugs in the V8 compiler, animated WebP decoder, and Crashpad memory safety mechanisms.
    • This marks the first $250,000 full-chain reward issued under Google's updated VRP rules introduced in April 2026.
    • AI significantly lowers the barrier for advanced vulnerability discovery, forcing defenders to reassess existing security boundaries.