# XBOW exploits Chrome with GPT-5.6 Sol, wins $250K bounty

Digest AI · Policy & Regulation · published 2026-10-12T17:01:00Z

Canonical: https://digestai.news/story/xbow-exploits-chrome-with-gpt-5-6-sol-wins-250k-bounty

## Summary

**XBOW** used OpenAI’s publicly available **GPT-5.6 Sol** model to discover and chain three previously unknown vulnerabilities in **Google Chrome** in just six days. The team, led by CEO **Oege de Moor** and researcher **Brendan Dolan-Gavitt**, exploited flaws in Chrome’s **V8 compiler**, a **WebP image decoder**, and **Crashpad**, bypassing both the renderer and V8 sandboxes on Windows. The exploit could allow JavaScript in a browser tab to execute code outside Chrome’s sandbox, affecting roughly **1 billion Windows users** globally. Google confirmed the findings and paid the maximum **$250,000 bounty**—the first full-chain payout of 2026 and only the second in the program’s history—after the team submitted their report in August 2026. XBOW’s compute costs for the effort totaled around **$40,000** in API fees, according to the company’s estimates. Google patched all three vulnerabilities shortly after validation. The rapid discovery raises concerns about the shrinking window between bug existence and exploitation, as AI-driven tools lower the barrier for even small teams or adversaries. While XBOW’s work was defensive, the same model could be weaponized by malicious actors with fewer resources.

## Key points

- XBOW chained three unknown Chrome flaws in six days using GPT-5.6 Sol, bypassing V8 and renderer sandboxes
- Google paid the full $250K bounty—its highest ever—for the first full-chain exploit of 2026
- Compute costs for the AI-assisted effort were ~$40K, per XBOW’s estimate

## Why it matters

The exploit demonstrates how AI can accelerate vulnerability discovery, narrowing the gap between bug discovery and exploitation. This could force companies to rethink bug bounty programs and security triage timelines as AI lowers the barrier for both defenders and attackers.

## Sources

1. [XBOW uses OpenAI’s GPT-5.6 to exploit Chrome, earns $250,000 bounty](https://cryptobriefing.com/xbow-gpt-5-6-chrome-exploit-bounty) (cryptobriefing.com, 2026-10-12)

## Cite

Digest AI, "XBOW exploits Chrome with GPT-5.6 Sol, wins $250K bounty", 12 October 2026, https://digestai.news/story/xbow-exploits-chrome-with-gpt-5-6-sol-wins-250k-bounty

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/xbow-exploits-chrome-with-gpt-5-6-sol-wins-250k-bounty.json