XBOW uses OpenAI’s GPT-5.6 to exploit Chrome, earns $250,000 bounty

A browser exploit chain that used to take elite researchers months just came together in six days. The tab for the AI that helped build it came to around $40,000. Autonomous offensive security company XBOW used OpenAI’s GPT-5.6 Sol model, working alongside human researchers, to find and exploit three previously unknown vulnerabilities in Google Chrome. Google paid out its maximum $250,000 bounty for the work. That was the first full-chain bounty awarded in 2026, and only the second in the history of the program. Three bugs, one chain, six days The campaign ran from August 2 to August 7, 2026. XBOW made it public on October 13, 2026. The timing had a certain flair. The team did the work during the Black Hat and DEF CON security conferences in Las Vegas. The chain stitched together three separate flaws. The first was a bug in the Maglev compiler inside V8, Chrome’s JavaScript engine. The second was a flaw in an animated WebP image decoder, tracked as CVE-2026-85045. The third was a memory safety issue in Crashpad. XBOW’s chain got through the renderer sandbox and the V8 sandbox on Windows. The result: JavaScript running in an ordinary browser tab could lead to unsandboxed code execut...