XBOW 藉助 GPT-5.6 Sol 六日完成 Chrome 漏洞利用鏈，獲 Google $250,000 獎金

AI Agents Cracked Chrome in Six Days — and Google Paid $250,000 for It

For decades, breaking into Google Chrome has been one of the hardest jobs in software. Elite researchers spent months — sometimes years — hunting for ways to escape the browser's layered defenses. Last week, security startup XBOW showed that the equation has changed: with the help of a publicly available AI model, a small team chained three previously unknown Chrome vulnerabilities into a full exploit in just six days, and Google handed them the maximum $250,000 bounty for it.

What Actually Happened

On October 13, XBOW disclosed that its researchers — led by CEO Oege de Moor and researcher Brendan Dolan-Gavitt — used OpenAI's GPT-5.6 Sol model, the same version available to any paying customer, to build a full-chain exploit against Chrome on Windows. The work ran from August 2 to August 7, roughly overlapping with the Black Hat and DEF CON conferences, and consumed approximately $40,000 in compute and API costs.

The chain was the real prize. Finding a single bug is one thing; connecting three unknown vulnerabilities to escape both the renderer sandbox and the V8 sandbox — the barriers that are supposed to contain malicious web pages — is what separates a curiosity from a weapon. Google confirmed the findings, reproduced the chain, patched all three flaws, and its vulnerability rewards panel approved the top payout on August 31. XBOW estimates the bugs could have affected roughly a billion Chrome users on Windows, though it saw no evidence of real-world exploitation.

Notably, this was the first full-chain reward paid under Chrome's Vulnerability Reward Program rules that Google revised in April 2026 — a fitting debut for a new era of AI-assisted security research.

Humans Were Still in the Loop

It is tempting to read this as "AI hacked Chrome," but XBOW's own account is more nuanced. The AI agents searched Chrome's enormous source code, tested hypotheses, drafted proof-of-concept programs, and wrote early versions of exploit components. Human researchers chose the targets, divided the work, reviewed every result, and decided which pieces fit together. When Google flagged that one bug in an early chain was already known, the team's modular design let them swap in a replacement without starting over.

Dolan-Gavitt didn't write the exploit himself — he directed an AI that did much of the grinding work. That division of labor is precisely what makes the result significant: the scarce resource is no longer the patience to read millions of lines of C++, but the expertise to steer a capable model and verify what it produces.

Why This Matters Beyond One Bounty

The economics are stark. A $250,000 reward for roughly $40,000 of compute and six days of expert time is a remarkable return — and a sobering one. Exploit brokers like Crowdfense have advertised up to $1.5 million for desktop Chrome zero-day chains, six times Google's award. If a small team with an off-the-shelf model can go from zero to sandbox escape in under a week, the window between a bug existing and a bug being weaponized shrinks dramatically, for defenders and attackers alike.

It also lands at a sensitive moment in AI policy. OpenAI classifies GPT-5.6 Sol as having high cybersecurity capability, just below its critical threshold. XBOW has predicted that AI agents could independently discover similar bugs within a year — a claim that remains unproven, but suddenly less easy to dismiss. Meanwhile, Google recently paused an open-source bug bounty program due to floods of low-quality AI-generated submissions. The two trends point the same direction: AI has already changed who finds bugs, even if it hasn't yet replaced who understands them.

The Bottom Line

The takeaway is not that Chrome is unsafe — Google patched everything, and users who keep their browser updated are protected. The takeaway is about tempo. Defensive processes, coordinated disclosure, and patch cycles are all built around the assumption that serious exploits take months of specialized human effort. Six days and $40,000 of compute breaks that assumption.

For the security industry, AI-assisted research shifts from novelty to baseline. For AI labs, it sharpens the debate over how capable models should be deployed. And for the rest of us, it's a reminder that the same tools promising to secure our software are also getting very good at breaking it.

Keep Chrome updated — and watch this space.