XBOW says GPT-5.6 agents chained three Chrome bugs in six days for a $250,000 bounty

Security firm XBOW has published a full exploit chain that turns a malicious web page into code running outside Chrome's sandbox, and credits AI agents built on OpenAI's GPT-5.6 Sol with much of the work. Google paid $250,000 for the report, which XBOW describes as the first award under its revised 2026 rules, according to a write-up on dev.to. Reconstructing usage from archived Codex logs, the company puts the six-day campaign at roughly $40,000 in API charges.

From a web page to code execution

The demonstration attached to XBOW's October 13 publication opens a crafted page in Chrome Beta on Windows and launches Calculator. Reaching that point required breaking through three separate walls: the renderer sandbox that treats web content as hostile, the additional sandbox V8 places around its heap, and finally the crash handler that runs outside both.

Per the dev.to write-up, drawing on researcher Brendan Dolan-Gavitt's technical account, the three stages were:

• A bug in V8's Maglev compiler, where a mutable HeapNumber was reused during deoptimization, granting read and write access inside V8's pointer-compression cage.
• A time-of-check/time-of-use flaw in Blink's animated-WebP decoder, in which cached frame geometry was combined with bytes swapped after an ArrayBuffer transfer, yielding one chosen native write outside the cage.
• A short-read retry flaw in Crashpad on Windows that trusted a suspended renderer's page protections, producing code execution in the unsandboxed crash handler.

A GBHackers summary relayed by the post lists the corresponding fixes: stop reusing mutable HeapNumbers, keep WebP output buffers inside bitmap bounds, and cap Crashpad retries at the original request length. XBOW says all three bugs are fixed and were never used against Chrome users. It cites Chromium issues 547819997, 548509153 and 545820931, and assigns CVE-2026-85045 to the WebP bug and CVE-2026-78952 to the Crashpad bug. No CVE was given for the V8 flaw, and none of XBOW's posts names the Chrome versions that carry the fixes.

The division of labour

In XBOW's account, the agents searched Chrome's source code, tested ideas, built proofs of concept and drafted the earliest versions of the exploit. The four named researchers — Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee and Willem Pinckaers — set the strategy, chose where to look, checked results and redirected the agents. Dolan-Gavitt emphasizes that a fair amount of human expertise and judgment went in as well.

The workflow matters as much as the model. Rather than asking one agent for an exploit end to end, XBOW ran five parallel campaigns with narrow goals: broad vulnerability search, V8 memory corruption, a V8 sandbox escape, a renderer sandbox escape, and integration — each with a clean interface and a backup route. The backups were needed. The chain's original V8-escape bug duplicated an existing Google report and had to be replaced with the WebP escape after what the team calls a stressful stretch, and an earlier chain died when its final stage overlapped a bug Google had already found internally. Dolan-Gavitt's takeaways: invariant violations look like territory where LLMs excel, and agents do better when given high-quality examples to follow.

The economics and the claims

XBOW estimates the same work would have taken a team of four six to nine months before LLMs. For market scale, CyberInsider notes that exploit broker Crowdfense advertises up to $1.5 million for desktop Chrome zero-day chains — an advertised ceiling, not a price anyone paid here. XBOW CEO Oege de Moor predicts that within a year each of the three bugs could be found by agents working on their own, a forecast worth weighing given the company sells AI-driven offensive security. The dev.to post adds a parallel data point: curl 8.23.0 shipped fixes for 24 CVEs on October 14, with 18 credited to an AI-driven audit by AISLE.

Reasons for caution

People steered every stage, and the six days sat on top of earlier research and failed submissions, as GBHackers points out. The $40,000 figure is XBOW's own reconstruction from its Codex logs and has not been audited. The one-billion-person figure is XBOW's estimate of exposure — people running Chrome on Windows — and the demo ran on signed Chrome Beta. Google has not commented publicly; CyberInsider reports the payment was approved on August 31, according to the public issue record.

Why it matters

The gap between a bug existing and someone finding it is shrinking, and so is the price of finding it — which means patch windows shrink too. The defensive steps are mundane but real: restart Chrome when the update button appears, since fixes apply on relaunch. If you ship Chromium inside Electron, Playwright or Puppeteer, browser fixes arrive only when you bump the package and redeploy, and because the final stage targets Windows crash-handler code, embedders should check their own release notes rather than assume. XBOW's closing advice applies well beyond browsers: assume your applications are exploitable, and test your own software before someone else's agents do.