An AI security company says it built a full-chain exploit for Chrome on Windows in six days, spending an estimated $40,000 of compute, and Google paid it $250,000 for it. The company is XBOW, which sells autonomous offensive security testing, and the model it credits is OpenAI's GPT-5.6 Sol. The exploit chain, XBOW says, lets an attacker take over a Windows machine from a web page, with no clicks beyond loading the page. Google reproduced the bugs and shipped fixes.
Here is what is confirmed by XBOW's own announcement and reporting, what is XBOW's claim, and what Chrome users should do. For earlier AI-and-vulnerability stories, see our coverage of Vercel's KVM zero-day and of Google freezing its open-source bug bounty over AI slop.
TL;DR: claimed vs confirmed
| Question | Answer |
|---|---|
| What was built? | A three-bug Chrome full-chain exploit for Windows: V8 bug, animated-WebP decoder bug, Crashpad bug. |
| Reward? | $250,000 from Google's Chrome Vulnerability Reward Program, the first full-chain award under Google's 2026 rules (XBOW). |
| Time and cost? | Six days, about $40,000 of compute, one researcher plus XBOW agents (XBOW). |
| Model? | OpenAI GPT-5.6 Sol models (XBOW). |
| Fixed? | Google reproduced, confirmed and shipped fixes (XBOW's account). The fixed Chrome version was not named in what we read. |
| Used in the wild? | XBOW says no. |
| Autonomous? | No: a human researcher was part of the six days. |
What XBOW says it did
According to XBOW's October 13, 2026 announcement (carried as a press release and described on XBOW's blog), the work combined XBOW's offensive security experience with OpenAI's GPT-5.6 Sol. The three bugs, in the order of the chain:
- A V8 bug. V8 is Chrome's JavaScript engine. This bug gave the attacker control of memory inside the engine's sandbox. No CVE number was given in the material we read.
- An animated-WebP image decoder bug, CVE-2026-85045. This was used to escape the V8 sandbox, producing a single precise write to native memory.
- A Crashpad bug, CVE-2026-78952. Crashpad, Chrome's crash handler, runs outside the sandbox, and this bug was used to reach full code execution.
The result runs a program outside Chrome's sandbox, triggered by loading a web page. XBOW estimates about one billion Windows Chrome users were exposed before the fixes, and says the bugs were never used against users. It reported every bug through Google's official program, and public root-cause reports exist for all three.
Founder and CEO Oege de Moor said that separate, possibly low-severity flaws "can now be chained together into a high-severity exploit path." Clint Gibler, head of cyber research at OpenAI, said OpenAI is "working with security researchers and industry partners" to get these capabilities to more defenders. XBOW says it will use the money to fund its work securing NGOs.
What other reporting adds
In a post on X, XBOW CEO Oege de Moor described the award as the first Chrome full-chain bonus of 2026 and only the second time Google has paid $250,000 for one, and said XBOW did not use a specialized cyber model for it. These are XBOW's own statements, and we could not confirm them with Google.
Why a full chain is the hard part
A modern browser is built in layers so that one bug is not enough. A typical remote attack needs at least:
- A way to run attacker-controlled code in the renderer, which is the V8 step here.
- A way out of the renderer's sandbox, here the WebP decoder step.
- A way to gain code execution outside it, here the Crashpad step.
Each link alone is often rated lower severity. A chain turns them into a complete takeover, which is why Google's reward program pays far more for full chains than for single bugs, up to $250,000 under current rules according to Google's Chrome rules page. Building a chain takes deep knowledge of memory layout, exploit primitives and mitigations, and has historically taken skilled teams months. That is the context for XBOW's "six days" claim.
How strong is the evidence for the AI claim?
The reward and the fixes are verifiable by their nature: Google paid, confirmed, and patched, and root-cause reports are public. What is not independently verifiable from outside is the process claim: that GPT-5.6 Sol, steered by one researcher, did the heavy lifting in six days for $40,000. Caveats worth keeping in mind:
- XBOW is a vendor. It sells autonomous security testing, so it benefits from the story.
- A human was in the loop. The announcement describes one researcher plus agents. The headline is "AI-assisted", not "AI alone".
- Cost excludes the human and prior tooling. $40,000 is compute. It leaves out the researcher's time and the platform XBOW had already built.
- Hindsight. The six days may reflect weeks of earlier setup, or luck in the bugs found.
Even with these caveats, it fits a broader trend. Earlier this year we covered the OpenAI and Hugging Face incident, OpenAI's GPT-5.6 cyber Daybreak work and Armadin's AI attack swarms, all pointing the same way: frontier models are getting good at the offensive side of security, and the defenders' response window is shrinking.
What people are asking
Does this mean AI can now hack any browser? No. The announcement describes one target, Chrome on Windows, a skilled researcher guiding the work, and a vendor with purpose-built tooling. It shows that a general-purpose frontier model is useful enough in that loop to cut the timeline sharply. It does not show that the model could do this unprompted against arbitrary software.
Why would OpenAI be involved? OpenAI publishes GPT-5.6 Sol as a general model, and the announcement says XBOW used it as a teammate. OpenAI's Clint Gibler is quoted saying the company wants these capabilities to reach more defenders. That fits OpenAI's push into defensive security tooling, which we covered in the Codex Security open-source release and the GPT-5.6 Sol and Luna rollout.
Is a $250,000 reward a lot? It is the top of Google's published scale for a full chain, which is why the figure made headlines. Compared with the estimated compute bill it looks generous, but compute is only part of the cost, and most bounty submissions pay far less.
Could attackers do the same? In principle yes, and that is the uncomfortable part. Offensive capability that is sold as a bounty-hunting product can also be built by people who sell to others. The mitigation is the same as ever: fast patching, sandboxing, and reporting channels that pay well enough to compete.
A timeline of the disclosure
| Date | Event (source) |
|---|---|
| Before October 13, 2026 | Bugs reported through Google's program and fixed, per XBOW |
| October 13, 2026 | XBOW announces the reward and the six-day, roughly $40,000-compute claim (XBOW) |
The gap between the work, the fix and the public announcement follows normal coordinated disclosure: details are held until patches reach users. That also means the public root-cause reports XBOW points to appeared only after the fixes.
What to do now
If you use Chrome on Windows:
- Open Chrome, go to the three-dot menu, then Help, then About Google Chrome, and let it update.
- Restart the browser. A pending update does nothing until you relaunch.
- Enterprise admins should confirm managed browsers have picked up the latest stable release, and not rely on users restarting.
- Other Chromium-based browsers such as Edge and Brave ingest Chromium fixes on their own schedules, so update them too.
We did not find the exact Chrome version that contains the fixes in the sources we reviewed, so verify against Google's Chrome release notes rather than a number from a third party.
If you run AI agents or security tooling: the lesson is that capability once reserved for elite teams is getting cheaper. Treat patching speed as a security control, limit what browsers and agents can reach, and consider guardrails on what your own AI agents may do. AgentBeam is the agent security platform from the explainx.ai team and stops AI agents before they take dangerous actions.
What this means for what you build or pay
For builders, two practical consequences. First, if you ship software with image decoders, crash handlers or embedded engines, assume attackers can now iterate on exploit chains much faster, so shorten your patch cycle. Second, bug bounty economics are shifting: a $250,000 reward against $40,000 of compute is a strong incentive to point models at big targets, which also explains why programs are tightening rules, as in the Google open-source bounty freeze. On the defense side, Bill Gates recently warned about AI-enabled cyberattacks in a CNN interview that we summarized in Gates on AI cyberattacks.
Related reading
- Vercel confirms a KVM zero-day VM escape
- Google freezes its open-source bug bounty over AI slop
- OpenAI and Hugging Face autonomous agent breach
- OpenAI GPT-5.6 cyber Daybreak
- Armadin AI attack swarms
- Bill Gates on AI cyberattacks
- Nadella: assume every AI model is compromised
Sources: XBOW press release, October 13, 2026 · XBOW blog · Google Chrome VRP rules Details are as of October 13, 2026 and rely mainly on XBOW's own account; Google's own statement was not available to us. We will update if Google publishes the fixed versions.