XBOW used AI agents to build a Chrome full-chain exploit in six days and won a $250,000 Google bounty

Security firm XBOW said on October 13, 2026 that Google paid it a $250,000 bounty for a Chrome full-chain exploit built in six days with AI agents running OpenAI's GPT-5.6 Sol. According to XBOW, all three bugs in the chain are now fixed.

What happened

• The chain links three bugs and can take over a Windows machine remotely through Chrome. XBOW estimates it affected about a billion users worldwide.
• One bug in its first chain was already known to Google, so that chain did not qualify and XBOW had to build a new one. The awarded chain was built from August 2 to August 7, 2026, using about $40,000 of compute (XBOW's own figure).
• XBOW says this is the first award under Google's new 2026 rules for Chrome full-chain exploits.

What the AI did and what people did

XBOW deliberately used a publicly available model rather than a specialized offensive one. In its account, the AI handled code search, testing, proofs of concept and early drafts, while four researchers set the strategy, chose where to look, checked the agents' work and redirected them. XBOW contrasts this with teams that used to spend about six months on similar work.

What Chrome users should do

Nothing beyond updating. XBOW advises relaunching Chrome when the update button appears. You can also open the ⋮ menu → Help → About Google Chrome to make the browser check for and install the latest version.