XBOW disclosed on October 13 that four researchers, supported by agents based on OpenAI’s publicly available GPT-5.6 Sol model and its predecessors, built a Chrome exploit chain for Windows in six days. The research earned a $250,000 reward from Google earlier this year, and the vulnerabilities were fixed before XBOW published the details. [1]

A full chain combines multiple flaws to cross defenses that would normally contain the damage from an isolated bug. In this case, XBOW says three vulnerabilities made it possible to move from a web page prepared by an attacker to code execution beyond the browser’s security boundaries and ultimately to control of the Windows system. The company estimates that the potential exposure reached more than one billion users. That is XBOW’s estimate based on Chrome’s reach, not a count of compromised machines. No evidence of active exploitation against users was presented.

The novel part is not that an AI acted alone. According to XBOW’s technical account, the agents searched Chrome’s source code, tested ideas, built proofs of concept, and wrote early versions of the exploit. The human researchers set the strategy, selected areas to investigate, checked the agents’ output, and redirected the work. The company estimates that it used about $40,000 in computing resources during the six days required to produce the rewarded chain. [1]

That division of labor matters when interpreting the result. The experiment demonstrates concrete acceleration inside a process directed by specialists, not an autonomous system that discovered and validated everything without supervision. It also used a substantial budget against a deliberately selected target. The outcome therefore does not show that any agent or organization can reproduce the same performance.

One part of the chain has public corroboration beyond XBOW’s announcement. The U.S. National Vulnerability Database describes CVE-2026-85045 as a race condition in V8 that allowed a remote attacker to execute arbitrary code inside the sandbox through a specially crafted HTML page. NVD rates it high severity and says it affected Chrome versions before 152.0.7977.82. [2] The entry points to Google’s official advisory for the stable desktop update released on September 3. [3]

The public record is not the same as an independent reproduction of the full chain. XBOW remains the primary source for the six-day timeline, computing cost, team composition, reward, and the agents’ exact role. NVD and Google corroborate the existence and remediation of at least one associated vulnerability, but they do not independently validate every operational claim about the experiment.

For users, the immediate action is straightforward: update Chrome and restart the browser so the corrected version becomes active. XBOW says all three flaws have been fixed. Publishing details after patches are available reduces risk, although it does not eliminate the possibility that others will study the vulnerabilities after disclosure.

The finding changes the economics of offensive security research more than the basic nature of the threat. Agents can expand the number of hypotheses a team examines and accelerate code review, testing, and documentation. The same capacity can benefit defenders and attackers. The strongest signal is that human oversight, coordinated disclosure, and update speed will become more important as publicly available tools shorten the time needed to assemble complex exploit chains.

Sources

[1] Read More — XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days
[2] Read More — NVD — CVE-2026-85045
[3] Read More — Chrome Stable Channel Update for Desktop — September 3, 2026