AI agent weaponizes live Chrome 0-day exploits autonomously in under 24 hours
cyb3rops · x · 2026-09-06
Developer @lordx64 shows how CyberKimi, an agent trained on Kimi, hunts Chrome bugs by starting from unpatched n-days. From a Sep 2 main-branch fix diff, the team caught a fresh V8 LLE aliasing bug and a SLICED-PARENT-FLIP race bug — both still live in every shipping Chrome stable, with no CVE published, meaning users are unprotected.
The exploit was weaponized autonomously in under 24 hours across three stages:
- Stage 1: deterministic LLE forge (bug 554421904)
- Stage 2: cage-escape prep — composing caged RW into sandbox-wide RW via a forged BigUint64Array external pointer, plus runtime binary-base leak to defeat ASLR without baked offsets
- Stage 3: PC control via a RegExp calling-convention desync, landing on a fully controlled string, then a JOP chain ending in a tail-call to system()
A landmark demo of autonomous agent-driven vuln research — and real threat intel for Chrome stable users.
More from coding & agent
- Code Arena Launches WebDev Leaderboard Ranking AI Coding Models — arena · 2026-09-06
- Astra handles UV unwrapping, hinting at automating artists' grunt work — rms80 · 2026-09-06
- Macroscope ships Murmur, the in-house tool that let engineers direct dozens of cloud agents — Rasmic · 2026-09-06
- Astra disappoints on harness-building tasks while Fable 5.1 excels, dev reports — HarveenChadha · 2026-09-06
- Andrew Ng: prompting will be dead in 6 months, graphs are replacing it — nikola_mr64990 · 2026-09-06
- GPT-6 Astra designs a working jet plant and ships a live 3D simulation autonomously — deanwball · 2026-09-06