{"version":1,"type":"story","url":"https://digestai.news/story/xbow-uses-gpt-5-6-sol-to-build-250-000-chrome-exploit-in-six-days","json":"https://digestai.news/story/xbow-uses-gpt-5-6-sol-to-build-250-000-chrome-exploit-in-six-days.json","markdown":"https://digestai.news/story/xbow-uses-gpt-5-6-sol-to-build-250-000-chrome-exploit-in-six-days.md","slug":"xbow-uses-gpt-5-6-sol-to-build-250-000-chrome-exploit-in-six-days","headline":"XBOW uses GPT-5.6 Sol to build $250,000 Chrome exploit in six days","summary":"Security firm XBOW earned $250,000 from Google’s Chrome bug bounty after its AI‑driven team built a full‑chain exploit in six days, from 2 to 7 August. The researchers, led by Brendan Dolan‑Gavitt, logged about $40,000 in compute costs, which they attribute to running OpenAI’s publicly available GPT‑5.6 Sol model.\n\nThe chain linked three previously unknown Chrome bugs: a Maglev compiler flaw in V8, a WebP decoder issue, and a Crashpad crash‑handler vulnerability (CVE‑2026‑78952). Together they allowed code execution from a simple web page on Windows machines, exposing roughly one billion users, according to XBOW. Google patched the bugs in Chrome 152 updates on 25 August and 3 September. The model GPT‑5.6 Sol was released to everyone in July and briefly paused in August over cyber‑risk concerns. XBOW’s founder Oege de Moor said the model was chosen because it was publicly accessible, and OpenAI’s head of cyber research Clint Gibler said the company wants to help defenders find and fix critical flaws faster.\n\nDolan‑Gavitt warned that “six days and $40k is not a lot of time or money when the payoff is a Chrome chain,” urging defenders to prepare accordingly.","keyPoints":["XBOW earned $250,000 from Google’s Chrome bug bounty for a full‑chain exploit built in six days.","The exploit chained three Chrome bugs and cost about $40,000 in compute, according to XBOW logs.","OpenAI’s publicly available GPT‑5.6 Sol was used; the model was later paused over cyber‑risk concerns."],"whyItMatters":"The case shows that publicly released LLM agents can quickly discover high‑impact browser vulnerabilities, heightening security risks while also offering a tool for defenders.","category":{"slug":"agents","name":"Agents & Tools","url":"https://digestai.news/category/agents"},"entities":{"companies":["XBOW","OpenAI","Google"],"models":["GPT-5.6 Sol"],"people":["Brendan Dolan‑Gavitt","Oege de Moor","Clint Gibler","Andrés Luksenberg","Baul Lee","Willem Pinckaers"]},"firstPublishedAt":"2026-10-17T06:49:00Z","updatedAt":"2026-10-17T06:49:00Z","sourceCount":1,"hasPrimarySource":false,"sources":[{"outlet":"thenextweb.com","title":"XBOW used GPT-5.6 Sol to build a $250,000 Chrome exploit in six days","url":"https://thenextweb.com/news/xbow-chrome-exploit-gpt-5-6-sol-250000-six-days","publishedAt":"2026-10-17T06:49:00Z","type":"press","primary":false,"lead":true}],"sourceNotes":null,"discussions":[],"thread":{"title":"AI Exploit Race XBOW Chrome Gambit","url":"https://digestai.news/thread/xbow-exploits-chrome-with-gpt-5-6-sol-wins-250k-bounty","storyCount":2},"cite":{"text":"Digest AI, \"XBOW uses GPT-5.6 Sol to build $250,000 Chrome exploit in six days\", 17 October 2026, https://digestai.news/story/xbow-uses-gpt-5-6-sol-to-build-250-000-chrome-exploit-in-six-days","publisher":"Digest AI","title":"XBOW uses GPT-5.6 Sol to build $250,000 Chrome exploit in six days","datePublished":"2026-10-17T06:49:00Z","url":"https://digestai.news/story/xbow-uses-gpt-5-6-sol-to-build-250-000-chrome-exploit-in-six-days"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}