Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

Researchers at XBOW leveraged OpenAI's GPT-5.6 Sol model to rapidly develop a full-chain Chrome exploit within six days, chaining three previously unknown vulnerabilities to achieve remote code execution on Windows without user interaction. The exploit bypassed Chrome's dual sandbox layers by exploiting flaws in V8, the animated WebP decoder, and Crashpad. Google has since patched all three vulnerabilities and awarded XBOW a $250,000 bug bounty. The demonstration highlights a significant reduction in the time and resources required to develop sophisticated browser exploits, raising concerns about future offensive capabilities.

AI-extracted · verify before operational use