XBOW says a six-day campaign using GPT-5.6 Sol produced a three-bug Chrome exploit chain that Google reproduced and rewarded with $250,000. That is a consequential result because a working chain demonstrates how separate weaknesses combine across defenses. It is stronger evidence than a scanner finding suspicious code or a model producing an unverified vulnerability report.
The team disclosed the result on October 13, 2026, after assembling the awarded chain from August 2 to August 7 during Black Hat and DEF CON. XBOW says all three flaws were fixed and no attacks against Chrome users were observed. The reporting does not establish an ongoing campaign against users, and the historical proof should not be confused with the condition of a fully updated browser.
The important qualification is human direction. Researchers selected targets, split investigations, reviewed outputs, supplied prior techniques and integrated the stages. The result shows a powerful expert-guided operation; it does not show a model independently compromising a hardened browser after receiving only a broad objective.
Three defects mattered because they crossed different boundaries
The first defect involved Maglev, V8's optimizing JavaScript compiler, and an incorrect assumption about mutable state during deoptimization. XBOW says it created memory access within V8's protected region. That was a useful primitive, not yet unrestricted execution outside the renderer.
The second flaw concerned animated WebP processing: information checked earlier could differ from the image data used later. XBOW identifies it as CVE-2026-85045. Its importance was moving beyond the earlier protected region and contributing to execution inside the renderer, rather than proving that one image bug alone bypassed every Chrome defense.
The final defect involved Crashpad, the Windows crash-reporting component operating outside the renderer sandbox. An assumption that a suspended process remained stable during diagnostic reads could fail. XBOW identifies this as CVE-2026-78952 and says the completed demonstration launched Windows Calculator outside the sandbox.
These stages illustrate a common conceptual weakness: treating state that can change as though it were fixed. The full chain established the consequence of linking those mistakes. XBOW's estimate of roughly a billion potentially affected Windows Chrome users describes reach, not a count of compromised machines or evidence of identical exposure on every device.
A duplicate finding made the modular design important
XBOW had pursued the project before the successful week. Its first chain took about two months, and Google later told the team that one component was already known. A duplicate can substantially reduce a report's reward value even when the technical work is real.
The researchers did not discard everything. They had separated stages into defined capabilities and maintained alternatives. Replacing the duplicated middle component with the WebP flaw let other parts survive. That recovery is evidence of research architecture and expert judgment, not just raw model persistence.
Agents searched source, tested hypotheses, generated candidate demonstrations and drafted components in parallel. Humans allocated attention and rejected weak paths. Prior work from XBOW's specialists also supplied reusable examples. The final six days therefore began with accumulated target familiarity and organizational knowledge, not an empty prompt.
XBOW compares the work with older full-chain projects involving four researchers over six to nine months. That is the team's historical assessment, not a controlled productivity study. Targets, available techniques, experience and luck differ. The campaign still shows that parallel agent work can compress substantial iteration when specialists know what to ask and how to assess it.
The compute estimate is not the price of a browser compromise
XBOW reconstructed approximately $40,000 of API usage from archived Codex logs for the awarded six-day campaign. That excludes researcher compensation, earlier attempts, the initial chain, infrastructure, management and accumulated expertise. The public logs are not a complete independently auditable accounting of all project work.
Comparing that number directly with $250,000 turns research into a misleading margin calculation. Failed attempts, duplicates, already patched issues and unreliable demonstrations can consume compute without payment. Google's rules also cap the number of full-chain bonuses following the April 2026 update; the reported reward is not an unlimited market for automated submissions.
Google's public program defines a qualifying complete chain on current supported systems with ordinary mitigations, without unsafe debugging flags. The category can be checked separately from XBOW's claims about being the first recipient or first of the model era. A public recipient history sufficient to confirm every historical ranking was not supplied.
Vendor reproduction and fixes give the result its strongest external anchor. They do not independently establish the precise human/model labor split, the whole economic cost or a universal six-day timetable. Those are different claims and require different evidence.
Expert guidance explains the apparent gap with model evaluations
OpenAI's predeployment evaluation found that GPT-5.6 Sol could discover flaws and useful exploitation primitives, but did not independently assemble a working full chain against hardened Chromium or Firefox in those tests. The company categorized it as highly capable in cybersecurity but below its critical threshold.
XBOW's experts handled the steps those evaluations identified as difficult: choosing valuable leads, distinguishing usable primitives from dead ends, coordinating alternatives and assembling the final path. The success is therefore not a straightforward contradiction of an autonomous-capability test. It shows how an expert organization can build a more capable system around a model.
That distinction matters for forecasts. Unsupervised target selection and stable integration would let less experienced operators scale differently. Expert-guided automation first amplifies organizations already holding techniques, test environments and reviewers. XBOW's prediction that agents could independently discover each bug within a year remains a prediction, not the result demonstrated here.
Agents also generate noise: duplicate findings, unexploitable crashes, misunderstood boundaries and fragile tests. A higher submission count is not equivalent to more dangerous novel flaws. The meaningful change would be more reproducible reports that survive novelty checks and demonstrate an actual security boundary crossing.
Defenders need faster validation, not panic over every AI report
The result gives vendors a reason to test their own assumptions across components and examine whether limited findings can combine. It also puts pressure on reproduction and patch validation capacity. Finding more weaknesses helps only if maintainers can distinguish real exposure from low-context claims and deploy effective fixes.
For Chrome users, XBOW's account points to an ordinary but consequential step: a shipped update must actually be loaded. Relaunching after an update and checking the browser's version state closes the gap between available remediation and a long-running old process. This is maintenance advice, not a claim that the repaired chain remains active in current releases.
The next strong evidence would be another vendor-confirmed chain on a different target, with transparent total time, human intervention and cost boundaries. Until then, XBOW's result should be read neither as a harmless demonstration nor as proof of on-demand autonomous compromise. It shows expert-guided AI making one difficult research workflow faster, while novelty, integration and accountability still determine the outcome.
Related reading on preserving working context: technical-document knowledge bases.