XBOW Built a $250,000 Chrome Full-Chain Exploit in Six Days Using AI

Security firm XBOW chained three then-unknown Chrome bugs into an attack that runs code on Windows when a user simply loads a web page. Researchers built it in six days by directing AI agents running OpenAI's public GPT-5.6 Sol model. Google confirmed and fixed all three bugs and paid XBOW its top bounty.

• Three Chrome bugs chained into code execution on Windows
• Exploit built in six days using AI agents on GPT-5.6 Sol
• Google confirmed and patched all three vulnerabilities
• XBOW received the top bounty of about $250,000