GPT-5.6 built a Chrome exploit in 6 days for $40k

A publicly available AI model just did what used to take a nation-state team half a year. Security firm XBOW announced on October 13, 2026 (UTC) that it built a full-chain Chrome exploit — three zero-days chained together to break out of both browser sandboxes and run code on a Windows machine — in six days using OpenAI's GPT-5.6 Sol. The cost: roughly $40,000 in API charges. Google confirmed all three bugs, fixed them, and paid XBOW its top $250,000 bounty.

What the chain actually did

A "full chain" means the attacker doesn't need the victim to click anything. Just loading a malicious webpage is enough. Chrome runs web code inside two nested sandboxes specifically to prevent that. This chain crossed both.

The three bugs sat in completely different parts of the browser:

The first bug gave control of memory inside Chrome's JavaScript engine. The second, in the image decoder, used that control to escape the engine's inner sandbox and make a single precise write to the host machine's memory. The third, in Crashpad — which runs outside the sandbox — turned that one write into arbitrary code execution on Windows. Both identified CVEs are rated high severity.

Before the fixes shipped, an estimated one billion people running Chrome on Windows were theoretically exposed. XBOW says the bugs were never used against real users.

The timeline

XBOW set the challenge at a January 2026 (UTC) all-hands meeting in Malta. Its first Chrome full-chain took two months. The awarded chain was built between Sunday, August 2, and Friday, August 7, 2026 (UTC) — during Black Hat and DEF CON in Las Vegas — by researcher Brendan Dolan-Gavitt working with AI agents. One version nearly failed when a bug it relied on turned out to be one Google already knew about; the team had built the exploit in swappable parts with backups, so they replaced that component and the chain held.

Google fixed the Crashpad bug in Chrome 152.0.7977.65 on August 25, 2026 (UTC), and the V8 bug in 152.0.7977.82 on September 3, 2026 (UTC). Chrome updates automatically, but fixes only take effect after a browser restart.

The speed is the story

Here's the comparison that matters:

"Pre-LLMs a Chrome full chain would take a team of four around 6–9 months to be produced," Dolan-Gavitt wrote. "Our first submission took 2 months. The awarded one? Six days."

XBOW deliberately used a model anyone can access — GPT-5.6 Sol via the public API — not a specialized security model or one with restricted access. The agents searched Chrome's source code, tested ideas, built proofs of concept, and wrote first drafts of the exploit. The human chose targets, supplied context, challenged the agents' results, and decided which pieces to chain together.

Why it matters

This isn't just another bug bounty story. It's a concrete data point in the debate over whether frontier AI models lower the barrier to developing sophisticated cyberweapons — and the answer, demonstrated here, is yes, dramatically.

The math is stark. A full-chain Chrome exploit is one of the most valuable commodities in offensive security. Governments pay millions for them on the open market. Google pays at most four $250,000 full-chain rewards per year. XBOW produced one for $40,000 in compute and six days of one researcher's time. That's a roughly 30-to-45-fold compression in time, and a cost that puts the capability within reach of far more actors than could previously afford it.

XBOW's framing is that defenders benefit too — they can test their own code with the same tools. That's true, but it assumes defenders move faster than attackers. The reality of software patching is that most organizations lag. Chrome auto-updates, but enterprise deployments, embedded browsers, and unpatched Windows machines remain exposed for months after a fix ships. If finding a full chain drops from months to days, the window between discovery and mass exploitation shrinks accordingly.

There's also a question OpenAI can't avoid. GPT-5.6 Sol is a general-purpose model, not a security tool. XBOW used it to find zero-days in one of the world's most hardened codebases. If a public model can do this at $40k a run, what can a model fine-tuned specifically for vulnerability discovery do? And at what point does "defensive security research" become indistinguishable from providing exploit-development infrastructure to anyone with a credit card?

XBOW CEO Oege de Moor argued against restricting model access, noting the model is already public. That's a fair point about the futility of closing the barn door, but it doesn't address what happens when the next generation of models makes this cheaper still.

What to watch

Three things will tell us whether this is a one-off or an inflection point. First, whether other security firms report similar AI-assisted full-chain exploits in the next six months — XBOW predicts agents could find each of the three bugs independently within a year. Second, whether Google and other browser vendors increase their bounty payouts or change their disclosure timelines in response to compressed discovery cycles. Third, whether OpenAI or any frontier lab introduces usage restrictions or monitoring specifically for exploit-development workflows on public APIs.

The bugs are fixed. The capability isn't going back in the box.