XBOW Researchers Use Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

Offensive cybersecurity firm XBOW has demonstrated that publicly available frontier models—not just restricted government or consortium-only cyber models—can compress full-chain browser zero-day exploit development from six to nine months of elite human labor down to just six days. Directing autonomous AI coding and debugging agents powered by OpenAI’s publicly accessible GPT-5.6 Sol model, XBOW researcher Brendan Dolan-Gavitt discovered and chained three previously unknown Google Chrome vulnerabilities into a working remote code execution (RCE) exploit on Windows that escaped both layers of Chrome’s nested sandbox upon visiting a malicious webpage.

Google’s security team validated the three-bug exploit chain, patched the flaws in stable Chrome desktop updates 152.0.7977.65 and 152.0.7977.82, and awarded XBOW $250,000—the maximum top-tier payout in Google’s Vulnerability Reward Program—marking the first time Google has ever paid its quarter-million-dollar top bounty for a full-chain browser exploit built with an AI agent.

The timeline of the sprint underscores how radically AI agents alter offensive security economics. Dolan-Gavitt initiated the project during the Black Hat and DEF CON security conferences in Las Vegas, building the initial end-to-end Chrome renderer-to-kernel sandbox escape chain in six days between August 2 and August 7, 2026. Even more tellingly, when Google informed XBOW after initial submission that one of the three zero-day bugs in the chain had recently been reported by another researcher, Dolan-Gavitt directed the GPT-5.6 Sol agent harness to locate an alternate vulnerability primitive and modularly swap the replacement zero-day into the working exploit chain without rebuilding the surrounding payload architecture.

Notably, XBOW did not rely on Anthropic’s restricted Claude Mythos 5.1 (Project Glasswing) or any classified government model checkpoint. Instead, the entire discovery, crash triage, heap layout grooming, and multi-stage sandbox escape assembly were executed using OpenAI’s commercially available GPT-5.6 Sol API paired with an iterative debugger and fuzzing harness.

As detailed in The Hacker News report on XBOW’s $250,000 six-day Chrome exploit chain, the milestone proves that restricting access to specialized “cybersecurity models” cannot prevent rapid exploit synthesis when general-purpose public coding models already possess sufficient reasoning and systems-programming capability to chain multi-sandbox browser zero-days on demand.

Fast Facts: XBOW $250K Chrome Full-Chain Exploit Sprint

• Research Organization & Lead: XBOW offensive security engineering team, led on this sprint by researcher Brendan Dolan-Gavitt.
• AI Model Used: OpenAI’s publicly available GPT-5.6 Sol general-purpose frontier model (no restricted cyber-consortium clearance required).
• Exploit Complexity: Chained 3 unknown Google Chrome zero-day vulnerabilities to achieve Windows Remote Code Execution (RCE) on page load, escaping both nested Chrome sandboxes.
• Development Velocity: 6 days (August 2–7, 2026 during Black Hat / DEF CON), compared to the historical 6 to 9 months required by human exploit development teams.
• Modular Bug Swap: When 1 of the 3 bugs collided with a prior report, the AI agent discovered a replacement zero-day and hot-swapped it into the exploit chain.
• Bounty & Remediation: Awarded Google’s top $250,000 bug bounty; patched in Chrome versions 152.0.7977.65 and 152.0.7977.82.

Exploit Development Economics: Human Teams vs. Public AI Agents

Why Model Access Restrictions Alone Cannot Contain Zero-Day Proliferation

Over the past month, policy debates around AI cybersecurity centered on whether frontier labs should lock top-tier models like Claude Mythos 5.1 inside vetted consortia such as Project Glasswing. XBOW’s $250,000 Chrome exploit chain shatters the assumption that offensive zero-day synthesis requires a specially gated model. Because writing a browser sandbox escape fundamentally relies on the same deep C++ codebase comprehension, pointer arithmetic analysis, and GDB/WinDbg trace interpretation required for legitimate systems engineering, any public model competitive on software engineering benchmarks (GPT-5.6 Sol, Gemini 4 Argon, or Claude Opus 5.5) can be driven by an expert harness to build full-chain exploits.

The 4-Step Enterprise Implementation Playbook

1. Force-Update Enterprise Chrome and Chromium Fleets to 152.0.7977.82+ Immediately: Use MDM (Jamf, Intune, Google Workspace Admin) to verify that 100% of corporate Windows, macOS, and Linux endpoints are running Chrome 152.0.7977.82 or later, eliminating exposure to the three chained zero-days.
2. Compress Browser Emergency Patch SLAs From 14 Days to 24 Hours: When a public LLM can construct a dual-sandbox Windows RCE chain in 6 days and hot-swap patched primitives in days, standard 14-day or 30-day enterprise patch rings leave endpoints exposed to N-day weaponization.
3. Deploy Continuous Agentic Fuzzing and Harness Auditing on Internal C/C++/Rust Code: Match offensive velocity with defensive automation by running autonomous security harnesses against your own memory-unsafe parsers, media codecs, and network daemons before every release.
4. Enforce Hardware-Backed Browser Isolation for High-Risk Roles: For finance, executive, and infrastructure administration endpoints, supplement Chrome’s OS-level sandboxes with remote browser isolation (RBI) or micro-VM containerization so even a dual-sandbox escape lands inside an ephemeral VM.