XBOW built a Chrome exploit chain in six days using an OpenAI model

XBOW, a US company specializing in AI-driven automated penetration testing, announced on October 13, 2026 that it had received $250,000 from Google for a complete exploit chain targeting Chrome on Windows. According to XBOW, it is the first reward of this size paid under the 2026 rules of Google's bug bounty program. What makes the case notable is the method: four researchers worked with AI agents built on GPT-5.6 Sol, a publicly available OpenAI model.

Three vulnerabilities, six days

According to a post by Oege de Moor, XBOW's founder, the rewarded chain was built from August 2 to 7, 2026, in Las Vegas. Google had rejected a first chain because it already knew about one of the flaws. The team replaced it with spare components prepared in advance. A separate technical write-up details the three bugs:

• an error in Maglev, one of the compilers of the V8 JavaScript engine;
• a TOCTOU (time-of-check to time-of-use) inconsistency, where the state changes between the check and the use, in Blink's animated WebP image decoder;
• a memory overflow in Crashpad, the crash reporting component, on Windows.

According to XBOW, a simple web page would have been enough to take control of a Windows PC. The company estimates the number of affected users at one billion, an estimate that is its own. Google reproduced the attack, confirmed the vulnerabilities and patched them. XBOW provides neither a CVE number nor the fixed Chrome version.

What the AI did, and what it did not do

XBOW describes a collaboration, not an autonomous attack. The agents explored Chrome's source code, tested hypotheses, built proofs of concept and wrote the first versions of the exploitation steps. The researchers set the strategy, chose where to look, checked the agents' work and redirected them based on early results. XBOW puts the compute bill at about $40,000 for the six days.

These figures come from the company, which sells this type of service and has an interest in promoting them. Google's reward does, however, support the main result: a complete chain against Chrome, an exploit long reserved for a few highly specialized teams, was produced in a few days with a mainstream model. For Oege de Moor, trying to restrict access to powerful models is not the right answer, since they are already available.

What to do

• Check that Chrome is up to date across all devices and that browsers have actually been restarted: a downloaded update only protects once the browser restarts.
• Shorten browser patch deployment times, because AI speeds up vulnerability research for defenders and attackers alike.
• Assume that some attacks will succeed: workstation segmentation and detection matter as much as patches.