Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

Security firm XBOW utilized OpenAI's public GPT-5.6 Sol model to develop a full-chain exploit for Google Chrome in six days. The AI agents chained three previously unknown Chrome bugs, enabling remote code execution on Windows systems via a malicious webpage. Google confirmed and patched the vulnerabilities, paying XBOW a $250,000 bounty. The AI's role in accelerating exploit development was demonstrated.

Severity: Critical · Category: Tool Misuse

Impact: A full-chain exploit for Google Chrome was developed in six days using an OpenAI model, demonstrating AI's capability to accelerate vulnerability exploitation.

Source: The Hacker News · Oct 14 2026 · Original source

What Happened

A team at security firm XBOW developed a full-chain exploit for Google Chrome in six days using AI agents running OpenAI's publicly available GPT-5.6 Sol model. The exploit chained three previously unknown Google Chrome bugs, allowing code to run on a Windows computer when a user merely loaded a web page. This attack bypassed Chrome's nested sandboxes, enabling code execution outside the browser on Windows without requiring user clicks or downloads. The development sprint occurred between August 2 and August 7, following months of earlier work that began with a challenge set in January. The six-day effort incurred approximately $40,000 in AI charges. AI agents were utilized to search Chrome's source code, test ideas, build proofs of concept, and draft exploit code, while researchers provided context, chose targets, challenged results, and decided which components to integrate.

Timeline

Technical Analysis

The full-chain exploit leveraged three distinct bugs to bypass Chrome's two nested sandboxes and achieve arbitrary code execution on a Windows machine. The first bug, located in V8, Chrome's JavaScript engine (CVE-2026-85045), granted the attacker control of memory within the engine. The second bug, found in the Animated-WebP image decoder (no public identifier listed), utilized this memory control to escape the inner sandbox and perform a precise write to the computer's memory. The third bug, residing in Crashpad, Chrome's crash handler (CVE-2026-78952), which operates outside the sandbox, converted that single memory write into full code execution on the system. The AI agents, specifically OpenAI's GPT-5.6 Sol model, assisted in the exploit development process by searching Chrome's source code, generating and testing ideas, creating proofs of concept, and drafting initial exploit code. Researchers, including Brendan Dolan-Gavitt, guided the agents by selecting targets, providing contextual information, evaluating the agents' outputs, and making decisions on how to combine the exploit components. During development, a reliance on a previously known bug was mitigated by XBOW's modular exploit design, allowing for a quick replacement of the component.

Impact

The exploit represented a critical security vulnerability, allowing remote code execution on Windows systems merely by a user loading a web page, bypassing all layers of Chrome's protection. Before the fixes were deployed, an estimated 1 billion people running Chrome on Windows were potentially at risk. Google confirmed the three bugs and awarded XBOW its top $250,000 bounty for a full Chrome exploit, marking it as the first full-chain Chrome reward under Google's updated 2026 rules and the first to an autonomous security company. The development process demonstrated a significant acceleration in exploit creation, with a single researcher and AI agents completing a full Chrome chain in six days, a task that previously took a team of four approximately 6-9 months. The AI-assisted development incurred about $40,000 in compute charges. The two publicly identified bugs were rated high severity.

Discovery & Response

The security firm XBOW discovered and reported the three bugs to Google. Google subsequently confirmed all three vulnerabilities and issued fixes. The bug in Crashpad (CVE-2026-78952) was fixed in Chrome version 152.0.7977.65 on August 25, while the V8 bug (CVE-2026-85045) was fixed in Chrome version 152.0.7977.82 on September 3. The Animated-WebP bug was also addressed within the Chrome 152 cycle. Although Chrome updates automatically, users were advised to restart their browser to ensure the fixes took effect and to confirm their version was 152.0.7977.82 or later. XBOW stated that the vulnerabilities were never exploited against Chrome users.

How Fencio prevents this

The tools worked exactly as designed. The agent called them with the wrong arguments, at the wrong time, or more often than it should have, and no layer checked whether the call made sense before it ran.

Fencio validates every tool call against expected intent: argument ranges, recipients, amounts, and call frequency. Calls that fall outside expected bounds, repeat without idempotency, or touch identity and money are held for confirmation.

All incidents