AI agents built a full Chrome exploit chain in six days

A team at the security firm XBOW chained three then-unknown bugs in Google Chrome into a single attack that runs code on a Windows machine when the user does nothing more than load a web page, the company said in a report covered by The Hacker News on 14 October 2026. XBOW said its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top bounty of $250,000.

The detail that matters for anyone tracking agent security is the model involved. According to the report, GPT-5.6 Sol is a public OpenAI model, not a restricted research build or a bespoke offensive system. The work was done by pointing agents at a target and supervising them, rather than by a human researcher manually auditing code. That puts a widely available commercial model at the centre of a piece of vulnerability research that browser vendors price at a quarter of a million dollars.

Full-chain exploits of this kind are usually the most expensive category in a bug bounty programme because they do not stop at a single crash or memory error. Chaining three separate flaws is what turns a browser bug into code execution on the underlying operating system, and in this case the report says the chain triggers on page load alone, with no further action from the person browsing. Google's payment of its highest reward is the vendor's own assessment of how serious the chain was.

The six-day timeline is the other figure likely to be picked over. The Hacker News report attributes it to XBOW, and the company is a vendor of AI-driven security testing, so the claim comes from an interested party. It is not clear from the report how much human direction the agents required, how many failed attempts preceded the working chain, or how the six days were measured.

What is confirmed by the browser vendor is narrower and firmer: three real bugs existed in Chrome, Google has fixed them, and the researchers were paid at the top rate. Users running an up-to-date version of Chrome are covered by those fixes. XBOW has not, according to the report, indicated that the chain was used against anyone outside its own testing.

The episode does not establish that agents can find such chains reliably, or that other teams can repeat the result. It does establish one data point: a publicly purchasable model, driven by a competent security team, produced a browser exploit chain that the vendor valued at the top of its scale. Defenders reading the report may want to treat patch latency in browser fleets as the practical takeaway, rather than the model name.