Xbow spent $40K on AI to crack Google Chrome

Researchers at Xbow USA spent six days and $40,000 in AI compute to find a vulnerability chain in Chrome that could have let attackers take over Windows machines. Google fixed the flaws and paid a $250,000 bounty, the first under its 2026 rules.

• AI compute for the hunt cost $40,000
• Exploit escaped both the V8 and OS process sandboxes to launch a Windows app
• Google paid a $250,000 bounty, the first under 2026 rules
• The team used the public GPT-5.6 Sol model, not specialist security tooling