XBOW built a full-chain Chrome exploit in 6 days with gpt-5.6-sol, earning Google's $250K first VRP bounty of 2026
moyix · x · 2026-10-22
XBOW is hosting a Reddit AMA with Brendan Dolan-Gavitt (moyix), its native team lead, live on Thursday 10/22, 12-1pm ET.
Per the AMA post, in August he used gpt-5.6-sol to attempt a full-chain exploit against Google Chrome and had a working chain in six days — chaining three vulnerabilities for remote code execution and a Chrome sandbox escape, earning $250,000 from Google's Chrome Vulnerability Reward Program (the first of 2026). He'll answer questions on where AI agents helped and where they didn't, vulnerability research, and exploit development, with a technical write-up and blog post linked.
More from Models
- Recursive launches Flint, a local coding model built in under 4 months, hitting 125+ tokens/sec on MacBook Pro — noahdgoodman · 2026-10-22
- Grok's in-tweet chat takes ~20s to first token, dev says Google AI search is faster — BraceSproul · 2026-10-22
- Blogger blind-tests Mistral Voxtral 3 French TTS against ElevenLabs after suspicious internal benchmarks — emmanuelvivier · 2026-10-22
- Datalab's Indra OCR: a 1M-parameter open model that hits 44 pages/s on CPUs, beating PaddleOCR — generativist · 2026-10-22
- Pretraining researcher Yingbo Zhou unveils Flint's first model — ChengleiSi · 2026-10-22
- Kimi K2.7 post-trained on 2,400 coding tasks lifts DeepSWE from 31% to 48.7% — echen · 2026-10-22