Six days with GPT-5.6 Sol: firm cracks Chrome and earns 250,000 dollars from Google
Security start-up XBOW used AI agents to build an attack chain against Chrome on Windows. Google has since fixed all three flaws.
Graphic: TERRA WORLD NEWS (own graphic based on the sources listed)
Security company XBOW disclosed on Tuesday that it used AI to build a full attack chain against Google's Chrome browser on Windows. Simply opening a booby-trapped web page would have been enough to run code outside the browser's sandbox. The chain linked three bugs – in the V8 JavaScript engine, the decoder for animated WebP images and the Crashpad crash reporter. Google paid 250,000 dollars through its reward programme; according to XBOW, all three flaws have been fixed.
The chain was built from 2 to 7 August while the team was in Las Vegas for the Black Hat and DEF CON hacker conferences. It used OpenAI's publicly available GPT-5.6 Sol model and its predecessors, with compute costs of around 40,000 dollars. Four researchers set the strategy, chose where the AI agents searched and checked their results; the agents combed through Chrome's source code, tested ideas and wrote early drafts of the exploits.
XBOW estimates that around one billion users were exposed before the fixes and expects AI agents to be able to find each of the three bugs on their own within a year. Google's own statement was not available. Users should keep Chrome up to date and restart the browser after updates.