XBOW Wins Google’s $250,000 Chrome Bounty With GPT-5.6 Sol

XBOW, which builds AI offensive-security researchers, said on 13 October 2026 that Google awarded it a $250,000 bounty for a full-chain exploit of Chrome, built by its researchers working with AI agents running OpenAI’s GPT-5.6 Sol. XBOW says the compute for the six-day campaign cost about $40,000 in API charges.

The bugs are now fixed, XBOW says, and it estimates the exploit affected about a billion users; CEO Oege de Moor’s X post describes them as users of Chrome on Windows. OpenAI president Greg Brockman shared the result on X the same day.

What XBOW Says It Built

XBOW says a full chain is a set of bugs that, used together, take an attacker from an ordinary web page to control of the computer itself. Its technical post says the final chain combined a V8 compiler bug, an animated-WebP decoder bug and a memory-safety bug in Crashpad.

The company says the award is the first $250,000 Chrome full-chain reward under the Vulnerability Reward Program rules Google introduced in April 2026. CEO Oege de Moor wrote on X that it was the second time in Chrome’s history Google had paid that amount for a full chain.

Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee and Willem Pinckaers took on the project, according to de Moor’s post. He says the team deliberately picked a model available to anyone, not a specialised security model or one with restricted access.

What Was Posted on X

Oege de Moor, XBOW’s founder and CEO, posted the full story on 13 October 2026: Google awarded XBOW a $250,000 bounty for a full-chain Chrome exploit, which he calls the second such award in Chrome’s history and the first under Google’s 2026 rules. He writes that the awarded exploit took 6 days and $40,000 of compute, and that restricting powerful models is not the answer because GPT-5.6 Sol is already public. These are XBOW’s own figures and his own view.

Greg Brockman, OpenAI’s president and co-founder, quoted de Moor’s post later the same day. He restates the 6 days and $40,000 of compute with GPT-5.6 Sol and the estimated 1 billion affected users, and writes that it highlights the opportunity for defenders to use these tools to secure their software. That is his view.

Rohan Paul, who summarises AI research on X, posted on 19 October about the arXiv paper in our 19 October update: across 200 runs from four agents, 60.4% of tokens went to understanding code and reasoning about how to trigger the bug, and the authors’ AVRI tool cut total cost by 18.0% for Codex and 23.7% for OpenCode on 20 tasks. His takeaway is to measure where a security agent’s tokens go before adding generic cost tricks. That is his summary and his advice; the figures are the paper’s own.

Six Days and $40,000

XBOW says Dolan-Gavitt and the agents built the awarded chain between Sunday 2 August and Friday 7 August, while the team was in Las Vegas for Black Hat and DEF CON. Before that, Google told the team it already knew about one of the bugs in its first chain.

Dolan-Gavitt writes that reconstructing usage from the archived Codex logs puts the six-day campaign at roughly $40,000 in API charges. In the same post he writes that before LLMs a Chrome full chain would take a team of four around six to nine months, and that XBOW’s first submission took two months.

De Moor writes that a veteran of a three-letter intelligence agency told him his team used to spend six months on this kind of vulnerability.

Who Did What: Agents and Researchers

XBOW describes the split this way: the AI searched Chrome’s source code, tested ideas, built proofs of concept and wrote the earliest drafts of the exploit. The researchers set the strategy, chose where to look, checked the agents’ work and redirected them.

The company says one human decision proved essential: the chain was built as three independent parts, each with an alternative, so a bug that had already been reported could be swapped out quickly. Dolan-Gavitt writes that this is what rescued the chain when its first V8 sandbox escape turned out to be a duplicate.

“Even with LLMs doing the vast majority of the work, you will have more success if you give your agents high-quality examples to follow,” Dolan-Gavitt writes.

What XBOW and Brockman Say It Means

“The cost and time of finding serious vulnerabilities are falling fast, for attackers and defenders alike,” de Moor writes. He argues that restricting access to powerful models is the wrong question, because the model XBOW used is already public.

XBOW says it believes that within a year each of the three bugs could be found by agents working on their own. Dolan-Gavitt adds that the result does not mean anyone can get a Chrome chain with that much time and money, but that the bar is significantly lower.

Brockman wrote on X that the result highlights the opportunity for defenders to use these tools to secure their software. XBOW says it is now developing an autonomous product for testing compiled software, such as desktop applications, servers and embedded devices.

Earlier today we covered Anthropic’s research on self-replicating AI and Reach Security’s Series B, two other views of how AI is changing security work. Our earlier report on OpenAI’s GPT-5.6 launch covers the model family XBOW used.

Update, 19 October: Where Security Agents’ Tokens Go

A research paper posted to arXiv on 8 October, “Where Do the Tokens Go? Understanding and Reducing Costs in LLM Agents for Vulnerability Discovery”, looks at the cost side of the kind of agent work XBOW describes above. Its authors studied 200 CyberGym traces from four agents (Codex, OpenCode, Cybench and EnIGMA), run without help and with four existing efficiency methods.

According to the paper, code localization and understanding, together with vulnerability reasoning and trigger design, account for 60.4% of tokens and are the two leading bottlenecks in failed runs. The authors also write that higher spending does not consistently yield better outcomes, and that only 24.4% of matched comparisons preserve success at lower total cost when existing efficiency methods are used.

The authors then present AVRI, an “Agent-centric Vulnerability Reasoning Interface” that keeps a persistent record linking how the harness consumes input to the conditions that make a chosen operation unsafe, so the agent can reuse that evidence instead of retrieving and reconstructing it. On 20 evaluation tasks, they report that AVRI reduces total cost by 18.0% for Codex and 23.7% for OpenCode while preserving success rates and improving or maintaining recall. These are the authors’ own results, which we have not reproduced.

As we read it, XBOW’s $40,000 of compute is the headline cost of agent-driven exploit work, and this paper finds that code localization and understanding, together with vulnerability reasoning and trigger design, took 60.4% of tokens in the 200 traces it studied, which is where its authors aim their savings.

The Structural Read

As we read it, the cost line is the business signal: XBOW reconstructs about $40,000 in API charges for the six-day campaign, and Dolan-Gavitt writes that the bar is significantly lower.

As we read it, the human role XBOW describes is design, not typing: the researchers set strategy, chose targets and built the chain in swappable parts, which XBOW says rescued it.

As we read it, XBOW is arguing against access limits: de Moor writes that restricting powerful models is the wrong question because the model it used is already public.

Three Implications

SECURITY TEAMS XBOW says to assume applications are exploitable and to test your own software before someone else does.

BUG-BOUNTY PROGRAMMES Dolan-Gavitt writes that bug collisions are a major risk now that everyone, Google included, is pointing LLMs at codebases like Chrome.

MODEL MAKERS Brockman wrote that the result highlights the opportunity for defenders; de Moor writes that restricting powerful models is the wrong question.

The Business Engineer Lens

This story maps onto the Business Engineer framework Inside Anthropic’s Permission Layer.

The framework puts it this way: “It is where decisions are made about who gets access to frontier intelligence, under what conditions, and for which purposes.”

As we read it, XBOW’s result tests that layer from the other side: it says it deliberately used a model available to anyone, and argues that restricting access is the wrong question.

What Is Not Established

We have not seen Google’s own statement or its reward listing. The award, its size and its place under the April 2026 rules are as XBOW and de Moor state them.

The billion-user figure is XBOW’s estimate, and the $40,000 is its own reconstruction of API charges from Codex logs. XBOW does not give a total cost including researcher time, and it does not say how much compute went into the first, rejected chain.

The comparisons with six to nine months before LLMs, and with an intelligence agency’s six months, are XBOW’s and an unnamed source’s; we could not check them.

The Bottom Line

XBOW says Google paid it $250,000 for a Chrome full-chain exploit its team built in six days with agents running OpenAI’s public GPT-5.6 Sol model, at about $40,000 in compute by its own reconstruction. XBOW says the bugs are fixed, and both XBOW and Greg Brockman frame the result as a reason for defenders to use the same tools on their own code.