Researchers at security company Xbow used OpenAI's publicly available GPT-5.6 Sol model to help build a working chain of Google Chrome exploits in six days, earning a $250,000 bounty from Google, CSO Online reported Friday. The episode suggests that one of the most expensive capabilities in offensive security, an attack that takes over a computer when its user simply visits a web page, is getting markedly cheaper to produce, which shortens the time organizations can safely wait before installing browser updates.
What Happened
Xbow described the work in an Oct. 13 company blog post and a longer technical write-up. According to the company, four human researchers worked alongside AI agents running the OpenAI model and built the final chain between Aug. 2 and Aug. 7, while the team was in Las Vegas for the Black Hat security conference. Xbow estimates the compute bill at about $40,000 in API charges, reconstructed from archived logs of OpenAI’s Codex coding tool.
Chrome runs web content inside "sandboxes," restricted compartments meant to keep a flaw in one part of the browser from reaching the rest of the machine. Xbow's chain broke through two of them. A bug in Maglev, a compiler inside Chrome's V8 JavaScript engine, gave the attack a foothold. A second flaw, in how the browser decodes animated WebP images, escaped V8's internal sandbox. A third, in Crashpad, Chrome's crash-reporting component on Windows, escaped the operating-system sandbox that confines the tab. The proof of concept ended by launching the Windows Calculator from a malicious page. The write-up lists the bugs as Chromium issues 547819997, 548509153 and 545820931 and says fixes have landed for all three. Neither Xbow's posts nor news coverage gives CVE identifiers, the standard public tracking numbers for vulnerabilities, or the Chrome versions that contain the fixes.
Xbow says the model searched source code, tested hypotheses, built proofs of concept and developed each stage, while the humans chose targets, challenged results and decided which pieces to combine. Xbow says an earlier chain, built over about two months, was disqualified because Google already knew about one of its bugs, and that one stage of the six-day chain turned out to duplicate a known issue and was swapped for a backup component. Google's award was, Xbow says, the first under the Chrome reward rules the company introduced in April. SecurityWeek also reported the award.
Why It Matters
Xbow's write-up estimates that before large language models, a four-person team would have needed roughly six to nine months to build such a chain. That is the company's own comparison, but it captures why the result matters beyond bug bounties: the price of an elite browser exploit is a rough measure of how many attackers can afford one.
CSO Online framed the chain as one that could in principle have reached about a billion Windows machines running Chrome. That is the publication's estimate, not a count of affected systems; nothing in the sources suggests the chain was used outside the research.
For boards and security leaders, the practical lesson is about patch timing. When exploits take months to build, a few days' delay in rolling out a browser update carries limited risk. When a small team with a public model can do it in a week, the gap between a fix shipping and attackers weaponizing the flaw narrows. Xbow's own advice to users is to keep Chrome current. The company ended its write-up with a blunt instruction: "Defend accordingly."
The Access Debate
In its blog post, Xbow argued that restricting access to such models is "the wrong question" because the model is already public, and said it expects AI agents working alone to be able to find each of the three bugs within a year. The finding adds to recent evidence on the same theme, including Anthropic's tests of an open-weight Chinese model that turned a known Chrome flaw into a working attack for about $20 in API fees.
What to Watch
- Whether Google publishes CVE numbers and fixed version details for the three Chromium issues.
- How quickly enterprises shorten deadlines for browser updates and forced restarts on managed devices.
- Whether other researchers report AI-assisted full chains, and whether bounty payouts shift as such work gets cheaper.
- Whether regulators and AI labs respond with tighter controls on cyber-capable models, an approach Xbow argues would come too late.
