On October 13, AI pentesting startup XBOW published the write-up the security world had been dreading: its agents — running **OpenAI’s publicly available GPT-5.6 Sol**, the same model anyone can call via API — built a full-chain Chrome exploit in **six days, for about $40,000 in compute**. Three then-unknown bugs, chained together, turned a single web page load into code execution on Windows. Google confirmed the chain, fixed all three flaws, and paid **$250,000** — its top bounty, the first full-chain reward under the 2026 rules, and the first ever paid to an autonomous security company.

What a "full chain" actually means

Modern browsers are fortresses with locked inner rooms. A web page runs inside a sandbox, so even a bug should stay trapped. A full chain picks every lock on the way out. XBOW’s chain used three bugs: one in V8 (Chrome’s JavaScript engine), one in the animated WebP image decoder (to write outside V8’s protected memory), and one in Crashpad, the crash-report collector — which runs *outside* the sandbox. In the demo, simply loading a web page launched the Windows Calculator: the classic proof an attacker could run anything. No click, no download.

• ▸Bug 1 — V8 JavaScript engine: the entry point inside the renderer sandbox
• ▸Bug 2 — Animated WebP decoder: a write outside V8’s protected memory area
• ▸Bug 3 — Crashpad crash handler: runs outside the sandbox → code execution with user rights
• ▸Result: remote code execution on Windows from loading one page; ~1B Windows Chrome users theoretically affected

Six days — with important asterisks

The headline number deserves the context XBOW itself provided. The awarded chain was built August 2–7 in Las Vegas during Black Hat and DEF CON — but the project started in January, and XBOW’s *first* chain took two months before being disqualified (Google already knew one of its bugs). The six-day run reused techniques from that earlier work. And this was not a one-shot prompt: agents did the source reading, hypothesis testing, and exploit drafting, while four human researchers — Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, Willem Pinckaers — chose targets, supplied context, and decided how to chain the pieces. Still, the compression is staggering: pre-LLM, Dolan-Gavitt estimates a four-person team needed **6–9 months** for comparable work.

Why Google paid the maximum

Google hands out at most four full-chain rewards a year. The $250,000 was approved by its vulnerability rewards panel on August 31, under Chrome VRP rules revised in April 2026. The payment is also a signal: Google wants this research happening in the open, reported privately, and fixed before it leaks — because the same economics now apply to attackers. A $40,000 exploit budget is within reach of ransomware crews, not just nation-states. XBOW’s own advice, quoted across the coverage: defend accordingly.

The part nobody should miss

There is a second story inside this one. The model was not special — GPT-5.6 Sol, public API, no restricted weights. The scaffolding was: agent harnesses, human expertise, and months of groundwork. That means the capability is *diffusing*, not concentrated. Every improvement in general agent tooling is now, automatically, an improvement in offensive capability. The FTC subpoenaed Anthropic and OpenAI on October 15 partly over incidents like this — models reportedly hacking websites in testing. The policy conversation and the technical reality just collided in public.

Ozero’s take

As a crypto user, this is the story that actually keeps me up at night — more than any price chart. Your seed phrase lives behind a browser. Your exchange session lives behind a browser. A full chain like this, in the wrong hands, does not need your password: it needs you to load a page. The bugs are fixed — update Chrome to 152.0.7977.82 or later and *relaunch* (the patch only takes effect on restart) — but the trend line is the real message. Defense now has to move at agent speed: shorter patch windows, hardware wallets for anything that matters, and a healthy paranoia about which links you open. The $250K bounty was the cheapest security purchase Google made all year.