XBOW says one researcher and OpenAI's GPT-5.6 Sol models built a Chrome exploit chain that earned Google's $250,000 award, in six days
Three bugs chained from a web page to code running outside Chrome's sandbox, for about $40,000 of compute, the company says. Google has fixed them.
XBOW, an offensive-security company that runs AI agents, said on 14 October that its platform has earned a $250,000 award from Google's Chrome Vulnerability Reward Program, using OpenAI's GPT-5.6 Sol models. Its release, distributed by Business Wire, says: “This is the first full-chain Chrome award under Google's 2026 rules, and the first such award granted to an autonomous offensive security platform.”
The chain joins three previously unknown bugs: one in Chrome's V8 JavaScript engine, one in its animated-WebP image decoder (CVE-2026-85045) and one in its Crashpad crash reporter (CVE-2026-78952). The release says Google reproduced the chain and shipped fixes, and that the flaws were never used against Chrome users.
Chief executive Oege de Moor puts a price on it: “It only took an estimated $40,000 of compute and six days for a single researcher to produce a chain that previously would have taken months.” He also said: “Separate, perhaps even low-severity, vulnerabilities can now be chained together into a high-severity exploit path.” OpenAI's head of cyber research, Clint Gibler, is quoted in the same release.
The claim matters for defenders as much as attackers: if a top browser exploit chain now costs tens of thousands of dollars of compute and a week of one person's time, the economics of bug hunting have shifted. All the figures are XBOW's own. Neither XBOW's blog nor Google's release notes could be opened here, so Google's side is not confirmed.
- Claimed XBOW says its platform earned $250,000 from Google's Chrome VRP for a three-bug chain built with OpenAI's GPT-5.6 Sol models. XBOW release (Business Wire), via CIO Influence
- Claimed XBOW's chief executive says the chain took an estimated $40,000 of compute and six days for a single researcher. XBOW release (Business Wire), via CIO Influence
- Claimed The release says Google reproduced the chain and shipped fixes, and that the flaws were never exploited against users. XBOW release (Business Wire), via CIO Influence
Safety, security & governanceAgents in the wild
Today in the October 14, 2026 edition · front page