XBOW Built a Chrome Full-Chain Exploit With a Public AI Model in Six Days

On October 13, security startup XBOW published how its research team used a publicly available OpenAI model — GPT-5.6 Sol and its predecessors — to build a working Chrome full-chain exploit: a victim loads a web page, and an attacker runs code on their Windows machine. Three bugs, six days, about $40,000 in compute, and Google's $250,000 top bounty. The bugs are now patched. The economics that produced them are not.

Developing story — first published 13:40 CEST (11:40 UTC), October 14, 2026. Updated as XBOW's technical write-up and Google's release notes publish more.

At a glance

What happened	A public AI model built a working Chrome full-chain exploit — remote code execution on Windows from loading one web page
Built by	XBOW's Native Team (Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, Willem Pinckaers)
AI model	OpenAI GPT-5.6 Sol (publicly available) and predecessors, driven by AI agents under human oversight
Bugs in the chain	Three independent bugs; an earlier chain was disqualified after Google said it already knew one of its bugs
Effort / compute	Six days (August 2–7, 2026, Las Vegas); approximately $40,000 in model compute
Reward	$250,000 — the first Chrome Full Chain Exploit Bonus paid under Google's 2026 rules
Exploited in the wild	No — a research result; the bugs were reported to Google and fixed
Fix status	All three bugs confirmed and fixed by Google; update Chrome and relaunch
Official write-up	XBOW, XBOW Built a Chrome Full-Chain Exploit (October 13, 2026)

What XBOW actually did

The project started in January at an XBOW all-hands in Malta, where the team set itself a browser full chain as a goal with a Black Hat deadline. The exploit was built across six days, Sunday August 2 to Friday August 7, 2026, in Las Vegas during Black Hat and DEF CON.

A Chrome "full chain" is the hard target Google's bonus program was designed around: an exploit that must result in a sandbox escape "with a demonstration of attacker control / code execution outside of the sandbox," performed remotely, with no or very limited reliance on user interaction. In practice that means chaining a renderer-side bug — the kind of memory-corruption primitive you get inside the tab — with a second, independent bug that breaks out of the sandbox and reaches the host OS. XBOW's awarded chain used three bugs, each engineered as an independent stage with a backup alternative. A first attempt was disqualified because Google already knew one of its bugs; the team built a fresh chain.

The division of labor matters. Per XBOW, the AI agents searched Chrome's source, tested ideas, built proofs of concept, and drafted the early exploit code; humans set strategy, chose which areas to focus on, checked the work, and redirected the agents when they stalled. This is autonomous offense with a human in the loop, not a one-shot prompt.

"We did it in six days," XBOW wrote, contrasting the effort with a "three-letter intelligence-agency veteran" whose team had spent six months on comparable work.

Why six days and $40,000 is the real headline

The $250,000 cheque is the attention-grabber — it matches Google's top payout for a Chrome sandbox escape, the same amount a researcher earned in 2025 for a single Mojo sandbox-escape bug. The input cost is the story. Browser full chains have been artisanal work — the province of a small number of elite researchers and well-funded nation-state teams, measured in months of specialist time. A six-day result for roughly $40,000 of model compute, directed by a handful of people using a model anyone can rent, moves that capability down several tiers of the threat pyramid.

	Then (the artisanal model)	Now (XBOW's run)
Who	Elite researchers, nation-state teams	A small team directing a public model
Time	Months	Six days
Cost	Specialist salaries, scarce talent	~$40,000 in compute
Scaling	Bounded by human experts	Bounded by GPU budget

When the binding constraint on exploit development shifts from scarce human expertise to GPU budget, the number of actors who can produce a browser zero-day goes up and the time-to-exploit goes down. That is a threat-model change, not a news item. It is the same shape as the AI that found a Linux kernel root bug nine years of humans had missed — the finding capability is no longer rate-limited by how many experts you can hire.

The model was the point: public, not a gated cyber model

XBOW was explicit that it did not use a specialized or restricted security model — it used one "available to anyone." That detail is the uncomfortable part.

OpenAI also ships a dedicated offensive model, GPT-5.6-Cyber, built on the same GPT-5.6 Sol base and gated behind its "Daybreak Red" vetted-access tier. On OpenAI's own internal benchmark of exploit-chain, authentication-bypass and privilege-escalation tasks, that cyber model solved 95% of requests against 1.5% for the standard guardrail-enabled model, and OpenAI's researchers used it to find two V8 flaws Google patched as CVE-2026-15903. The implicit safety bet is that keeping the sharp model behind vetting contains the capability.

XBOW just built a browser full chain without the gated model. Gating the "cyber" SKU does not put the capability back in the box when the base model — the one everyone can call — is already enough with the right scaffolding around it.

Remediation

This is a research result, not in-the-wild exploitation, and the fix is genuinely easy. The exposure is not the bugs; it is how slowly a fleet actually applies the fix.

1. Am I affected? Any Chrome user on a build released before the fix. Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) share the same engine and inherit these classes of bug once their upstream merges land. Check your version at chrome://settings/help (it shows the current build and whether an update is pending); audit the fleet through your management console rather than trusting individual users.
2. Patch — and relaunch. Confirm Chrome is on the latest Stable channel. Chrome downloads updates in the background but does not apply them until the browser is relaunched, so an "up to date" installer with a 20-day-old running process is still vulnerable. Force a relaunch via policy (RelaunchNotification / RelaunchNotificationPeriod) instead of waiting for users.
3. Can't relaunch everywhere immediately? There is no real compensating control for a renderer-plus-sandbox-escape chain other than patching — Site Isolation is already on by default and does not stop this. Reduce exposure on laggard endpoints: restrict high-risk browsing, keep users off local-admin where you can, and prioritize internet-facing and high-value hosts.
4. Hunt. No vendor IOCs exist, because this was not used against anyone — do not let a tool invent paths or hashes here. The generalizable signals for any browser exploitation are the browser spawning unexpected child processes, a cluster of renderer crashes, or code execution following a sandbox escape. Map detections to MITRE ATT&CK T1189 (Drive-by Compromise), T1203 (Exploitation for Client Execution) and T1068 (Exploitation for Privilege Escalation).
5. Verify. After the fleet relaunches, confirm the running build everywhere — then measure how long that took. That number is your actual window against the next browser zero-day, and it is the thing worth fixing.

What is not known yet

• The three CVE IDs and the exact fixed Chrome build are not in XBOW's post; it points to a companion technical write-up by Brendan Dolan-Gavitt for the bug-level detail. Confirm specifics against the Chrome Releases blog before treating any CVE as part of this chain.
• Whether the chain's bugs overlap with other recent AI-found Chrome issues (such as CVE-2026-15903, found separately with the gated GPT-5.6-Cyber) is not stated — treat them as distinct until the technical post says otherwise.
• The exact agent orchestration — how many agents, which tools, how the runs were scored — awaits the technical write-up.

The defender's move: run the same offense first

If a small team can direct a public model to a Chrome full chain in six days, the honest planning assumption is that someone will point the same class of capability at your software and your perimeter. The defensive answer is not to hope the model stays gated — XBOW just showed it doesn't need to be. It is to run that offense against yourself, first, continuously.

That is what Zero Hunt is built to do: an autonomous AI red team whose 10-agent swarm fingerprints each target and writes a fresh, per-target exploit with a local model, then its sealed coding agent iterates a runnable proof-of-concept until it demonstrably works — the same "build the chain, don't recall it" loop, every skill backtested in the AI Gym before it touches production. It runs on-premise on private models (ZeroHunt Apex and Apex Pro), so nothing about your environment leaves the appliance and no vendor can throttle, refuse or revoke the capability — the opposite of depending on a gated access tier someone else controls. Every exploit runs in an ephemeral container and a human in the loop gates every action that matters, with each finding signed at write time for the audit trail. If you want this pointed at your own attack surface rather than read about it after a bounty payout, that is automated penetration testing done the way the attackers now do it — see the platform or get in touch.