Breaking

Google Awards $250,000 for Chrome Exploit Built in Six Days Using OpenAI AI Model

October 13, 2026 at 21:34 EDT

Foundation Models
Security
AI Agents

Google has awarded a $250,000 bug bounty to XBOW, an AI-assisted security research platform, for a full-chain exploit of Chrome that was built in just six days using OpenAI's GPT-5.6 Sol model. The award represents the first $250,000 full-chain bounty under Google's revised Vulnerability Reward Program rules introduced in April 2026 and underscores a dramatic shift in how security researchers discover vulnerabilities.

October 14, 2026 · Security

AI Accelerates Chrome Exploit Development 50× Faster

Google's $250,000 bounty to XBOW demonstrates how frontier AI models are reshaping vulnerability discovery timelines and costs.

The Six-Day Exploit

Days to build full chain
(August 2–7, 2026)

~$40K

Compute cost
(OpenAI API)

Time Compression: AI vs. Manual

Manual

~6 months

AI-Assisted

6 days

50× speedup with GPT-5.6 Sol

The Exploit Chain: Three Linked Vulnerabilities

1. V8 Compiler Bug

Memory corruption inside JavaScript engine sandbox

2. WebP Decoder Flaw (CVE-2026-85045)

Escape V8 sandbox via animated image processing

3. Crashpad Bug (CVE-2026-78952)

Memory-safety flaw enables code execution outside main sandbox

Result: Arbitrary code execution on Windows from a single malicious webpage.

Impact & Industry Shift

Google patched 1,072 defects in Chrome 149–150 combined; surpassed entire prior 23-release cycle.
First $250K full-chain VRP award under new April 2026 rules; validates AI-assisted research.
Dual-use risk: Defenders can access GPT-5.6-Cyber for security work; attackers may exploit same capabilities.
Velocity at scale: AI agents now essential to keeping pace with automated exploit discovery.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.