An off-the-shelf AI model helped XBOW build a Chrome full-chain exploit in six days for $40,000

What happened

XBOW, a company that builds autonomous offensive security tools, published details on 13 October of a "full chain" exploit for Chrome on Windows. Chrome is built in layers, so a single bug usually gives an attacker control of one web page and no more. A full chain links several bugs to get from a web page to the computer itself. XBOW's chain used three previously unknown bugs, and it estimates the affected group at about one billion Chrome users.

XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days (XBOW)XBOW's own account of the exploit, the team, the cost and its forecast.xbow.com →

Google paid a $250,000 reward through its Chrome Vulnerability Reward Program. Per XBOW, it is the first full-chain Chrome award under Google's 2026 rules. Forbes reports that Google confirmed the findings and the maximum reward about a month after Black Hat. All three bugs are fixed.

XBOW says the compute for the awarded chain cost about $40,000 and the final build took six days, from 2 to 7 August, while its team was at the Black Hat and DEF CON conferences in Las Vegas. It adds that a veteran of a three-letter intelligence agency told its CEO his team used to spend about six months on this kind of work.

How it was built

XBOW says the project began at a company meeting in January, when its CEO set the team a target: build AI agents that attack desktop software, and test them on the hardest case, a Chrome full chain, before Black Hat in August. Four researchers took it on. The agents ran on OpenAI's GPT-5.6 Sol and its predecessors. XBOW says it picked a model anyone can use and avoided specialized security models and restricted ones.

The work was split between people and agents. Per XBOW, the agents searched Chrome's source code, tested ideas, built proofs of concept and wrote the first drafts of the exploit. The researchers set strategy, chose where to look, checked the agents' work and redirected them.

The first chain the team built did not qualify, because Google already knew about one of its bugs. The team had built the chain as three independent parts, each with an alternative, so it could swap in a backup. One researcher, Brendan Dolan-Gavitt, then built the awarded version with the agents between 2 and 7 August. That means the six days build on earlier work on the first chain, and the cost of that earlier work is not stated.

What the numbers mean

The $40,000 of compute is about a sixth of the $250,000 reward, so on these figures the economics favor the finder. XBOW calls the compute an estimate and ties it to the awarded chain over six days. It does not count the earlier chain that was dropped.

The six days against six months comparison rests on a single unnamed intelligence-agency veteran quoted by XBOW. It is an anecdote with no measurement behind it.

Other work points the same way. In an earlier test reported by GBHackers, the security firm Hacktron gave three frontier models only the public fix commits for Chrome's JavaScript engine. Only GPT-5.6 Sol Ultra completed a working renderer exploit, at a reported cost of about $1,600 in tokens. That test covers one layer of Chrome. XBOW built the full chain.

What defenders can do now

XBOW gives two pieces of advice. First, keep Chrome current and relaunch it when the update button appears, because a fix only takes effect after a restart. Second, assume your own software is exploitable, test it before someone else does, and plan for attacks that get through anyway. Its argument is that defenders hold an advantage attackers lack, since they can test their own code first, and the same public models are available to them.

Tools for that work already exist. Google says Gemini 4 Argon was trained for cyber defense and can find, validate and patch vulnerabilities on its own. Access is staged, and trusted defenders get a version without cyber guardrails.

Guardrails are one hurdle for defenders. When Hugging Face investigated an attack by AI agents, the guardrails on commercial models blocked requests to analyze the attack material, so it used an open-weight GLM model on its own servers instead. Teams analyzing real exploit code may hit the same wall with hosted models.

XBOW says it is building an autonomous product for testing compiled software, such as desktop applications, servers and embedded devices, and is recruiting design partners.

What comes next

XBOW's forecast is that within a year, agents working alone could find each of the three bugs. It says the time and cost of finding serious vulnerabilities are falling for attackers and defenders alike, and that asking whether to restrict powerful models is the wrong question when the model it used is already public. Its CEO told Forbes that defenders have to mobilize and patch as much as they can.

The reward system is already adjusting. When Google overhauled its Android and Chrome programs in the spring, it asked researchers for concise reports with proofs and essential artifacts, since AI can now write long analyses automatically, and it scaled back payouts for flaws AI has made easier to find, per BleepingComputer. The top Chrome full-chain reward is up to $250,000.

Attackers use the same tools. Forbes reported in September that a hacker used a mix of AI models, including DeepSeek and Claude, to hit more than 100 companies within days. Per Forbes, XBOW is waiting on Google to review two more exploits. Per SMBtech, XBOW will use the $250,000 to help secure non-governmental organizations.

What to check

• Nearly all details come from XBOW's own account, and XBOW sells security tools. Forbes reports that Google confirmed the findings and the reward. A statement from Google itself was not found.
• The one billion figure is XBOW's estimate, and it applies to Chrome on Windows.
• The $40,000 is an estimate for the awarded chain. It leaves out the earlier chain that was dropped.
• The six months comparison is one unnamed person's remark, and the one-year forecast is XBOW's opinion.
• This article leaves out exploit technique on purpose. XBOW says all three bugs are fixed and has published a companion post with technical detail.

Sources

1. XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days (XBOW, 13 Oct): the account of the exploit, team, cost, timeline and forecast.
2. How An Off-The-Shelf OpenAI Model Found Three Google Chrome Zero-Days (Forbes): Google's confirmation, the CEO's comments, two pending exploits, the September attack report.
3. XBOW Rewarded for Exploit Affecting a Billion Users (press release) and SMBtech: the first-award claim and what XBOW will do with the reward.
4. GBHackers on Hacktron's test: the earlier exploit test and its token cost.
5. BleepingComputer on Google's reward changes: the Chrome and Android program overhaul.
6. Gemini 4 Argon announcement (Google): Google's defensive cyber claims and staged access.
7. Hugging Face technical timeline: the use of an open-weight GLM model for forensics.