Key Notes
- XBOW says its AI-assisted Chrome exploit earned a $250,000 Google bounty after researchers demonstrated code execution outside the browser sandbox.
- The awarded campaign took six days and approximately $40,000 in API usage, with experienced security researchers directing and validating the agents.
- The vulnerabilities are now fixed, and the disclosure describes earlier research rather than a newly unpatched attack against Chrome users.
Security researchers at XBOW used OpenAI’s GPT-5.6 Sol to help build a Google Chrome exploit that earned a $250,000 bounty. The company disclosed the work on October 13, saying the demonstrated attack could escape the browser and run code on a Windows computer. The vulnerabilities have been fixed.
OpenAI co-founder Greg Brockman highlighted the result as an example of AI’s potential for software defense. XBOW puts the awarded campaign at six days and approximately $40,000 in API charges. That spending estimate covers model usage during the sprint, rather than the entire cost of the research.
Four experienced researchers worked alongside the agents, choosing targets, checking findings and redirecting searches. XBOW deliberately used a publicly available model. Its account describes a collaboration between security specialists and AI, with human judgment remaining important to the outcome.
What the Chrome Exploit Demonstrated
The technical report describes a three-stage chain involving Chrome’s V8 JavaScript engine, an animated WebP decoder and the Crashpad crash handler. The demonstration opened Windows Calculator from a page running in Chrome Beta, showing that execution could cross the browser’s protective boundaries.
That distinction explains why a full chain matters. A flaw confined to a browser process and a route to running software outside that process represent different levels of access. Linking weaknesses across those boundaries turns several individual findings into a more consequential security result.
Google’s September 3 release notes credit XBOW researcher Brendan Dolan-Gavitt with reporting CVE-2026-85045, a V8 vulnerability addressed in Chrome 152.0.7977.82/.83 for Windows and Mac. The exploit disclosure concerns earlier research, rather than an announcement of a newly unpatched attack on current installations.
Six Days Followed Earlier Research
The successful campaign ran from August 2 through August 7. XBOW’s earlier submission had taken two months, and the team carried that experience into the new attempt. Describing the result as an entire Chrome research program completed from scratch in less than a week would leave out that preparation.
Duplicate discoveries also complicated the work. One version used a vulnerability Google already knew about, so researchers substituted a backup stage. Building interchangeable components gave them a way to preserve useful work when one finding could no longer support the submission.
The $250,000 reward and $40,000 model bill are striking, but their difference is not a measure of profit. Researcher salaries, earlier unsuccessful work and other operating costs would need to be included in a financial assessment. Nor does this single project establish that another team could reproduce the outcome with the same budget.
AI Bug Hunting Still Needs Useful Evidence
The broader challenge is turning automated searches into findings that developers can verify and repair. Our coverage of Google’s bug-report pause shows the burden created by invalid AI-generated submissions. A working demonstration provides a different kind of evidence from an unverified claim about suspicious code.
That emphasis on validation also underpins OpenAI’s collaboration with Trail of Bits, which we examined in our acquisition report. Finding a potential weakness, confirming its significance and delivering a reliable fix remain distinct parts of security work.
For Chrome users, Google’s update guidance explains how to check the installed version under Help and About Google Chrome. Available updates require a relaunch to take effect. The practical lesson from this disclosure is to apply those fixes, while treating the experiment as evidence of changing research capabilities rather than proof of a current mass compromise.
Disclaimer: AIstify is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and insights on artificial intelligence, emerging technologies, automation, and related industries. NuvexMedia LLC invests in and collaborates with companies across the AI, technology, software, and digital innovation sectors. These relationships do not influence AIstify’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2026 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
