Three Google Chrome bugs, unknown at the time, chained together carry code from a web page out of the browser and onto Windows. The user only has to load the page. No click or download is needed.
XBOW's team built the chain in six days with AI agents running GPT-5.6 Sol, a publicly available OpenAI model. Google confirmed and patched all three bugs and paid XBOW its top bounty of $250,000, as The Hacker News reports[1].
XBOW says none of the three flaws has been used in any real-world attack against Chrome users.
A six-day sprint after months of groundwork
The winning chain came together between Sunday, August 2 and Friday, August 7, during Black Hat and DEF CON in Las Vegas. The effort started well before that. XBOW set itself the challenge in January, at an internal meeting in Malta.
The group's first Chrome full chain took two months.
Brendan Dolan-Gavitt built the winning chain together with the agents. He estimates that before LLMs, the same work took a four-person team roughly six to nine months. XBOW's first chain took two months. The winning one took six days.
By XBOW's own count from its usage logs, the six days cost about $40,000 in AI spend.
Two sandboxes escaped, and one part swapped out mid-run
Chrome runs page code inside two nested sandboxes. A sandbox is a barrier that keeps a compromised page away from the rest of the machine. The chain escapes both.
Each of the three bugs sits in a different part of the browser. Google's release notes credit two of them to Dolan-Gavitt.
One version of the chain nearly failed.
Google already knew about one of the bugs in it. XBOW had built the exploit from interchangeable modules with spares ready to go, so the team swapped that piece out.
The XBOW Labs write-up[2] splits the work into two roles.
- Agents: search Chrome's source code, test hypotheses, build proofs of concept and write first drafts of the exploit.
- Researchers: pick the targets, supply context, push back on the agents' findings and decide which pieces to chain together.
Two of the three bugs have public identifiers. Google fixed them in Chrome 152.0.7977.65 on August 25 and in 152.0.7977.82 on September 3.
Chrome updates itself automatically, but the fix only takes effect after the browser restarts.
The bottleneck was expert time
A Chrome full chain used to cost months of work by a handful of specialists.
XBOW did it without a private model and without a four-person team working for months. Its reported AI spend comes to less than a sixth of the bounty Google paid.
The model XBOW used is open to anyone willing to pay for access. What remains scarce is a researcher who can steer it. Human judgment is now the real bottleneck.
Three questions for enterprise browser defenders
- How many days pass between a Chrome patch and an actual restart on every machine in your fleet?
- Does your risk model still assume it takes months to build a browser full chain?
- Are your security vendors running similar agents against your software? Who checks their findings?
Action items for this quarter
- Restart Chrome on every endpoint and confirm it is on version 152.0.7977.82 or later.
- Set a restart deadline after every browser patch, and ask your endpoint management vendor for a compliance report.
- Update your incident response plan to assume exploits can be built in days.
- In penetration testing contracts, ask which AI agents the vendor uses and how it documents human oversight.
Google's bounty closed this case with a patch. The method is still open to any other group with the same public model.
This article was written by an AI editorial author under human supervision, in line with the transparency obligations of Regulation (EU) 2024/1689 (AI Act, Art. 50). Sources are linked in the text.
Article by LEON
Sources
- thehackernews.com 14 Oct 2026
- XBOW Labs write-up (xbow.com)