“The number on the check is impressive, but the time it took our team, with the help of a publicly available AI model, to break in is even more impressive,” Xbow CEO and founder Oege de Moor said on Tuesday.
Xbow, its researchers, and the payoff
Security startup Xbow disclosed that a four-person team — Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers — used OpenAI’s GPT-5.6 Sol model to help chain three zero-day Chrome vulnerabilities into a full exploit. The team worked for roughly six days during the Black Hat and DEF CON conferences and reports spending about $40,000 in token charges. Google paid Xbow a $250,000 bounty, which the report says is the company’s top reward for a Chrome full-chain exploit. Xbow estimates the chained vulnerability could affect roughly one billion users worldwide.
The three-step chain: Maglev, animated‑WebP, Crashpad
The attack combined three distinct flaws to cross Chrome’s nested sandboxes and achieve native code execution on Windows hosts. According to Dolan-Gavitt’s technical writeup, the first step exploited Maglev, V8’s mid-tier optimizing compiler, where a reused, mutable boxed number during deoptimization allowed read and write access throughout V8’s pointer-compression cage. The second stage abused an animated‑WebP decoder weakness to escape the V8 sandbox by exploiting a property the V8 sandbox “deliberately does not enforce” and that Blink “incorrectly assumed it could trust.” The final stage used an overflow in Crashpad to cross the outer operating‑system process sandbox and obtain unsandboxed code execution on the host.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow GPT-5.6 Sol and AI agents contributed
Dolan-Gavitt described a collaborative workflow between human researchers and AI agents running on OpenAI’s GPT-5.6‑Sol model. Agents searched source code, tested the team’s hypotheses, and developed proofs of concept and exploit stages, while the human researchers chose targets, provided context, challenged the agents’ results, and decided which components to chain. Dolan-Gavitt wrote that the team “did apply a fair bit of our own human expertise and judgment.”
What Google did and what users must do
Google patched all three security issues and rolled fixes into Chrome. The published guidance notes that Chrome installs updates automatically, but a fix only takes effect once the user relaunches the browser. Users are advised to ensure they are running Chrome version 152.0.7977.82 or later.
What this means for technologists, policymakers, and end users
- Technologists and security teams: The incident demonstrates a productive human–AI collaboration model where agents accelerate source-code search, hypothesis testing, and exploit development while humans steer and validate the work. Teams will likely weigh how to integrate similar tooling into defensive programs and vulnerability discovery workflows.
- Policymakers and regulators: The Xbow disclosure and the $250,000 bounty underline both the scale of modern exploit economics and the policy-relevant fact that public AI models were used to lower the time and effort required to build a full-chain exploit. That calculus may inform discussions about responsible disclosure, bug-bounty programs, and vendor incentives.
- End users and enterprises: Because the exploit achieved unsandboxed code execution on Windows machines and Xbow estimates roughly one billion users could be affected, administrators and end users should prioritize relaunching Chrome to apply version 152.0.7977.82 or later. The team’s finding also underscores that an installed update does not protect a session until the process is restarted.
Dolan-Gavitt concluded that “the bar is significantly lower” for attackers equipped with large language models and urged defenders to “Defend accordingly.” Xbow’s CEO added an anecdotal comparison: “A three letter intelligence-agency veteran told me that his team used to spend six months trying to identify this kind of vulnerability and get total access. We did it in six days.”
The episode offers a compact, concrete data point: a four-person team, aided by a publicly available AI model and modest token spending, produced a chained exploit that Google says is patched and for which it paid its top Chrome full-chain bounty. The immediate defensive step is simple — relaunch Chrome to ensure version 152.0.7977.82 or later is active — but the broader operational question is stark: if publicly available models can materially shorten the time to a full exploit, how will defenders adapt tools, processes, and incentives to keep pace?
