XBOW’s GPT-5.6 Sol agents build a $250k Chrome full-chain exploit in six days

Your AI and this story

Key facts

• Reward: ‘the first $250,000 Chrome full-chain reward under the VRP rules introduced in April 2026’; Google confirmed the chain launched Calculator (XBOW Labs)
• Bugs: (1) V8 Maglev reused a mutable boxed number during deoptimization → read/write in V8’s pointer-compression cage (Chromium issue 547819997); (2) Blink animated-WebP decoder → one native write outside the cage (issue 548509153); (3) Crashpad trusted a failed read from a ‘frozen’ renderer → heap overflow and code execution in the crash handler (issue 545820931). All three fixed; no CVE ids given
• Time and cost: built Aug 2–7, 2026 (during Black Hat week) by Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee and Willem Pinckaers; about $40,000 of API charges, reconstructed from archived Codex logs. XBOW estimates a pre-LLM full chain at 6–9 months for a team of four; its own first Chrome full chain took about 2 months
• Model: OpenAI’s publicly available gpt-5.6-sol (and predecessors), chosen deliberately instead of a restricted cyber model such as Mythos
• Division of labour: agents searched source, tested hypotheses, built proofs of concept and exploit stages in parallel campaigns; humans chose targets, supplied context, challenged results and decided what to combine
• Duplicate collision: a first version’s Gin-based V8 sandbox escape duplicated a bug Google already knew (issue 542670566) and was replaced with the WebP stage within hours
• CEO Oege de Moor: ‘For the first time ever, defenders have access to the skills of attackers at the click of a button’; he expects agents working alone to find each of the three bugs within a year. Orchestration details due at the Unprompted conference at the end of October