{"schema":"postcutoff/event@1","as_of":"2026-10-14T07:26:00+02:00","url":"https://postcutoff.com/e/2026-10-13-xbow-chrome-full-chain-gpt-5-6-sol-250k/","md":"https://postcutoff.com/e/2026-10-13-xbow-chrome-full-chain-gpt-5-6-sol-250k/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-13-xbow-chrome-full-chain-gpt-5-6-sol-250k","date":"2026-10-13","date_precision":"day","short_title":"XBOW's GPT-5.6 Sol agents build a $250k Chrome full-chain exploit in six days","deck":null,"takeaway":"Google paid its first $250,000 full-chain reward under the 2026 VRP rules; all three bugs are fixed.","category":"agents","category_label":"Agents","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":[{"n":1,"title":"XBOW (Oege de Moor): XBOW built a Chrome full-chain exploit (Oct 13)","url":"https://xbow.com/blog/xbow-built-a-chrome-full-chain-exploit","type":"official","group":"primary","domain":"xbow.com"},{"n":2,"title":"XBOW Labs (Brendan Dolan-Gavitt): Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain","url":"https://xbow.com/labs/research/zero-to-calc-in-six-days-inside-xbow-chrome-full-chain","type":"official","group":"primary","domain":"xbow.com"},{"n":3,"title":"Forbes: It cost $40,000 to find a Google Chrome zero-day bug with AI (Oct 13)","url":"https://www.forbes.com/sites/the-wiretap/2026/10/13/how-an-off-the-shelf-openai-model-found-three-google-chrome-zero-days/","type":"press","group":"press","domain":"forbes.com"},{"n":4,"title":"Startup Fortune: XBOW researchers used AI agents to win a $250,000 Chrome exploit bounty","url":"https://startupfortune.com/xbow-researchers-used-ai-agents-to-win-a-250000-chrome-exploit-bounty/","type":"press","group":"press","domain":"startupfortune.com"},{"n":5,"title":"Runtime Wire: XBOW earns Google's $250,000 bounty with a six-day Chrome exploit","url":"https://runtimewire.com/article/xbow-six-day-chrome-exploit-google-bounty","type":"press","group":"press","domain":"runtimewire.com"}],"official":2,"filed":"2026-10-14","updated":"2026-10-14","orgs":["XBOW","OpenAI","Google"],"title":"XBOW wins Google's first $250,000 Chrome full-chain reward of 2026 for a three-bug exploit built in six days with GPT-5.6 Sol agents","summary":"On Oct 13, 2026 XBOW disclosed a Chrome full-chain exploit (renderer bug in V8 Maglev, V8 sandbox escape via the WebP decoder, renderer sandbox escape via Crashpad) that four researchers built from Aug 2 to Aug 7 with agents running OpenAI's public GPT-5.6 Sol model, for about $40,000 in API charges. Google paid its first $250,000 full-chain reward under the 2026 VRP rules; all three bugs are fixed.","key_facts":["Reward: 'the first $250,000 Chrome full-chain reward under the VRP rules introduced in April 2026'; Google confirmed the chain launched Calculator (XBOW Labs)","Bugs: (1) V8 Maglev reused a mutable boxed number during deoptimization → read/write in V8's pointer-compression cage (Chromium issue 547819997); (2) Blink animated-WebP decoder → one native write outside the cage (issue 548509153); (3) Crashpad trusted a failed read from a 'frozen' renderer → heap overflow and code execution in the crash handler (issue 545820931). All three fixed; no CVE ids given","Time and cost: built Aug 2–7, 2026 (during Black Hat week) by Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee and Willem Pinckaers; about $40,000 of API charges, reconstructed from archived Codex logs. XBOW estimates a pre-LLM full chain at 6–9 months for a team of four; its own first Chrome full chain took about 2 months","Model: OpenAI's publicly available gpt-5.6-sol (and predecessors), chosen deliberately instead of a restricted cyber model such as Mythos","Division of labour: agents searched source, tested hypotheses, built proofs of concept and exploit stages in parallel campaigns; humans chose targets, supplied context, challenged results and decided what to combine","Duplicate collision: a first version's Gin-based V8 sandbox escape duplicated a bug Google already knew (issue 542670566) and was replaced with the WebP stage within hours","CEO Oege de Moor: 'For the first time ever, defenders have access to the skills of attackers at the click of a button'; he expects agents working alone to find each of the three bugs within a year. Orchestration details due at the Unprompted conference at the end of October"],"key_numbers":[],"tags":["cybersecurity","exploit","chrome","v8","bug-bounty","ai-agents","gpt-5-6-sol","offensive-security"],"science":null,"body_md":"## What happened\n\nXBOW, an AI offensive-security company, set its team the goal of a Chrome full chain at the start of 2026. During Black Hat week\nin August four researchers ran parallel agent campaigns on OpenAI's public GPT-5.6 Sol and assembled a three-stage chain from a\nweb page to code execution outside Chrome's sandbox on Windows. After Google fixed the bugs, XBOW published the details on Oct 13.\n\nSome coverage says XBOW has two more exploits under Google review; XBOW's own posts do not say so, so it is unverified here.\n\n## Why it matters\n\nA Chrome full chain used to take an expert team months. Here it took six days and about $40,000 of a public model's API time,\nwith humans steering. That is concrete evidence that frontier-model exploit capability is already in non-restricted models.","disputed":[],"related":[{"id":"2026-10-01-google-pauses-oss-vrp-ai-slop","url":"https://postcutoff.com/e/2026-10-01-google-pauses-oss-vrp-ai-slop/","date":"2026-10-01","date_precision":"day","short_title":"Google pauses product-flaw reports to its open-source bug bounty after a flood of invalid AI-generated submissions","deck":null,"takeaway":"Cheap LLM-generated security reports are overwhelming human triage.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":4,"official":1,"filed":"2026-10-04","updated":"2026-10-05","orgs":["Google"]},{"id":"2026-09-18-hacktron-claude-hacks-openai","url":"https://postcutoff.com/e/2026-09-18-hacktron-claude-hacks-openai/","date":"2026-09-18","date_precision":"day","short_title":"Three-person startup Hacktron used Claude to break into OpenAI's employee accounts and GitHub ($6,500 bug bounty)","deck":null,"takeaway":"The intrusion took under 72 hours in July 2026 and was reported through OpenAI's bug bounty, which paid $6,500.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":3,"official":0,"filed":"2026-10-01","updated":"2026-10-01","orgs":["Hacktron AI","OpenAI","Anthropic"]}],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-14","type":"filed","text":"Created (Google News: Startup Fortune)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-14","run":null,"sources_read":null,"updated":"2026-10-14","human_review":null,"version":null},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":166,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":105,"in_training_data":false},{"model_id":"gemini-4-argon","name":"Gemini 4 Argon","cutoff":"2026-03","days_after":196,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":135,"in_training_data":false}],"short_url":null}