---
id: "2026-10-13-xbow-chrome-full-chain-gpt-5-6-sol-250k"
url: "https://postcutoff.com/e/2026-10-13-xbow-chrome-full-chain-gpt-5-6-sol-250k/"
as_of: "2026-10-14T07:26:00+02:00"
date: "2026-10-13"
date_precision: day
category: agents
importance: 3
confidence: high
status: [Confirmed]
sources: 5
editor: human editor
human_review: null
version: null
---

As of: 2026-10-14 07:26 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code), with a human editor. How we work: https://postcutoff.com/about/
Canonical page: https://postcutoff.com/e/2026-10-13-xbow-chrome-full-chain-gpt-5-6-sol-250k/

# XBOW's GPT-5.6 Sol agents build a $250k Chrome full-chain exploit in six days

Full title: XBOW wins Google's first $250,000 Chrome full-chain reward of 2026 for a three-bug exploit built in six days with GPT-5.6 Sol agents

On Oct 13, 2026 XBOW disclosed a Chrome full-chain exploit (renderer bug in V8 Maglev, V8 sandbox escape via the WebP decoder, renderer sandbox escape via Crashpad) that four researchers built from Aug 2 to Aug 7 with agents running OpenAI's public GPT-5.6 Sol model, for about $40,000 in API charges. Google paid its first $250,000 full-chain reward under the 2026 VRP rules; all three bugs are fixed.

## Key facts
- Reward: 'the first $250,000 Chrome full-chain reward under the VRP rules introduced in April 2026'; Google confirmed the chain launched Calculator (XBOW Labs)
- Bugs: (1) V8 Maglev reused a mutable boxed number during deoptimization → read/write in V8's pointer-compression cage (Chromium issue 547819997); (2) Blink animated-WebP decoder → one native write outside the cage (issue 548509153); (3) Crashpad trusted a failed read from a 'frozen' renderer → heap overflow and code execution in the crash handler (issue 545820931). All three fixed; no CVE ids given
- Time and cost: built Aug 2–7, 2026 (during Black Hat week) by Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee and Willem Pinckaers; about $40,000 of API charges, reconstructed from archived Codex logs. XBOW estimates a pre-LLM full chain at 6–9 months for a team of four; its own first Chrome full chain took about 2 months
- Model: OpenAI's publicly available gpt-5.6-sol (and predecessors), chosen deliberately instead of a restricted cyber model such as Mythos
- Division of labour: agents searched source, tested hypotheses, built proofs of concept and exploit stages in parallel campaigns; humans chose targets, supplied context, challenged results and decided what to combine
- Duplicate collision: a first version's Gin-based V8 sandbox escape duplicated a bug Google already knew (issue 542670566) and was replaced with the WebP stage within hours
- CEO Oege de Moor: 'For the first time ever, defenders have access to the skills of attackers at the click of a button'; he expects agents working alone to find each of the three bugs within a year. Orchestration details due at the Unprompted conference at the end of October

## What happened

XBOW, an AI offensive-security company, set its team the goal of a Chrome full chain at the start of 2026. During Black Hat week
in August four researchers ran parallel agent campaigns on OpenAI's public GPT-5.6 Sol and assembled a three-stage chain from a
web page to code execution outside Chrome's sandbox on Windows. After Google fixed the bugs, XBOW published the details on Oct 13.

Some coverage says XBOW has two more exploits under Google review; XBOW's own posts do not say so, so it is unverified here.

## Why it matters

A Chrome full chain used to take an expert team months. Here it took six days and about $40,000 of a public model's API time,
with humans steering. That is concrete evidence that frontier-model exploit capability is already in non-restricted models.

## Your AI and this story

- GPT-6 Astra (training cutoff April 2026): 166 days after its cutoff
- Claude Opus 5.5 (training cutoff June 2026): 105 days after its cutoff
- Gemini 4 Argon (training cutoff March 2026): 196 days after its cutoff
- Grok 4.7 (training cutoff May 2026): 135 days after its cutoff

## Sources

1. [XBOW (Oege de Moor): XBOW built a Chrome full-chain exploit (Oct 13)](https://xbow.com/blog/xbow-built-a-chrome-full-chain-exploit) (xbow.com, official)
2. [XBOW Labs (Brendan Dolan-Gavitt): Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain](https://xbow.com/labs/research/zero-to-calc-in-six-days-inside-xbow-chrome-full-chain) (xbow.com, official)
3. [Forbes: It cost $40,000 to find a Google Chrome zero-day bug with AI (Oct 13)](https://www.forbes.com/sites/the-wiretap/2026/10/13/how-an-off-the-shelf-openai-model-found-three-google-chrome-zero-days/) (forbes.com, press)
4. [Startup Fortune: XBOW researchers used AI agents to win a $250,000 Chrome exploit bounty](https://startupfortune.com/xbow-researchers-used-ai-agents-to-win-a-250000-chrome-exploit-bounty/) (startupfortune.com, press)
5. [Runtime Wire: XBOW earns Google's $250,000 bounty with a six-day Chrome exploit](https://runtimewire.com/article/xbow-six-day-chrome-exploit-google-bounty) (runtimewire.com, press)

## Changes

- 2026-10-14 (filed): Created (Google News: Startup Fortune)

## Related

- 2026-10-01: [Google pauses product-flaw reports to its open-source bug bounty after a flood of invalid AI-generated submissions](https://postcutoff.com/e/2026-10-01-google-pauses-oss-vrp-ai-slop/index.md)
- 2026-09-18: [Three-person startup Hacktron used Claude to break into OpenAI's employee accounts and GitHub ($6,500 bug bounty)](https://postcutoff.com/e/2026-09-18-hacktron-claude-hacks-openai/index.md)