XBOW Uses AI to Build Full Chrome Exploit Chain in 6 Days, Wins $250K Bounty

AI-driven security research hit a landmark in Chrome bug hunting: security firm XBOW disclosed that it built a complete Chrome exploit chain in just 6 days, earning the first $250,000 full-chain bounty paid under Google's new VRP rules from April 2026. Around the same time, Google engineer gdb used GPT-5.6 Sol to find a critical Chrome vulnerability in 6 days for roughly $40,000 in compute. Many observers say AI is pushing the pace of security auditing and offense/defense to unprecedented levels.

Confirmed

According to @moyix, XBOW's full Chrome chain combined three bugs: a V8 compiler memory corruption, a V8 sandbox escape via the animated-WebP decoder, and a renderer sandbox escape through Crashpad (moyix called the last one his favorite part).
The achievement earned the first $250,000 full-chain bounty under Google's new April 2026 VRP rules, affecting roughly 1 billion users.
XBOW's fedek said a professional team typically needs about a year to build a full Chrome exploit chain, whereas XBOW's AI automation did it in just 6 days (moyix reshared this claim). The timeline from finding all the bugs to completing the chain is particularly striking.
Google engineer gdb revealed he used GPT-5.6 Sol over 6 days and about $40,000 in compute to find a critical vulnerability in Chrome; he believes such tools are hugely valuable for defenders, letting software teams find bugs before attackers do.

Why it matters

AI compressed the cost and time of top-tier vulnerability research by orders of magnitude—from roughly a year for human teams down to 6 days—meaning both attackers and defenders are gaining unprecedented capabilities, and defenders need to fold AI auditing into development workflows ASAP.
The first $250,000 full-chain bounty under the 2026 rules also signals Google's official recognition of AI-produced full exploit chains and the direction of its incentives.

2026-10-13 ~ 2026-10-14 · 6 related posts

Primary sources

XBOW nets $250K Google bounty for Chrome full-chain exploit using 6 days and $40K of GPT-5.6 Sol compute — gdb · 2026-10-14 01:43 (UTC+08:00)
XBOW Details Chrome Full-Chain Exploit: 3 Bugs, 6 Days, $250K Google Bounty — moyix · 2026-10-13 23:41 (UTC+08:00)
GPT-5.6 Sol finds critical Chrome vulnerability after 6 days and $40,000 of compute — gdb · 2026-10-14 01:39 (UTC+08:00)

[source] XBOW Details Chrome Full-Chain Exploit: 3 Bugs, 6 Days, $250K Google Bounty — moyix · 2026-10-13
Full-chain Chrome exploit with all bugs found by agents in six days — moyix · 2026-10-13
XBow built a full Chrome exploit chain in 6 days vs a pro team's year — moyix · 2026-10-13
[source] GPT-5.6 Sol finds critical Chrome vulnerability after 6 days and $40,000 of compute — gdb · 2026-10-14
[source] XBOW nets $250K Google bounty for Chrome full-chain exploit using 6 days and $40K of GPT-5.6 Sol compute — gdb · 2026-10-14

1 near-duplicate retellings: moyix