Security researchers spent 6 days doing their Chromework, built 1B user exploit

Researchers at security startup Xbow used OpenAI's GPT-5.6 Sol model to help chain three zero-day vulnerabilities in Chrome into an exploit capable of executing code outside the browser's sandbox on Windows machines.

Xbow estimates that this could affect about one billion users worldwide.

Google fixed all three, and paid the Xbow team a $250,000 bounty, its top reward for a Chrome full-chain exploit.

The payout also proves a nice return on investment for the human bug hunters - Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers - who spent just six days during the Black Hat and DEF CON conferences and about $40,000 in token charges to discover the vulnerabilities and build the attack chain.

“The number on the check is impressive, but the time it took our team, with the help of a publicly available AI model, to break in is even more impressive,” Xbow CEO and founder Oege de Moor said on Tuesday.

“A three letter intelligence-agency veteran told me that his team used to spend six months trying to identify this kind of vulnerability and get total access.

We did it in six days.” In a separate technical writeup about the attack chain, Dolan-Gavitt detailed the work done by humans and AI agents.

Agents, using OpenAI's GPT-5.6-Sol model, searched source code, tested the team’s hypotheses, and developed proofs of concept and exploit stages, he said.

Meanwhile, the AI pen-testing security startup’s researchers chose targets, provided context, challenged the agents’ results, and decided which attack components to chain.

"We did apply a fair bit of our own human expertise and judgment," he wrote.

Crossing two security boundaries in 3 steps Google’s Chrome browser uses several layers of security to protect users, and this includes sandboxes - barriers to contain compromised code and ensure that someone who hacks an individual website can’t take over the entire computer.

This includes deploying the V8 sandbox to prevent any memory corruption flaws in the V8 JavaScript engine from impacting other memory.

The V8 sandbox sits inside the operating-system process sandbox, and this nested design means that escaping V8's memory restrictions doesn't automatically grant native code execution.

Even if an attacker achieves native code execution inside Chrome's renderer, the outer process sandbox restricts access to the rest of the machine.