Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
-
A team at security firm XBOW has demonstrated a full-chain Google Chrome exploit built with the help of a publicly available OpenAI model, chaining three previously unknown Chrome bugs into a single attack that executes code on a Windows machine when the victim simply loads a web page.
The researchers assembled the exploit in six days by directing AI agents running OpenAI's public GPT-5.6 Sol model. According to the company, the resulting chain was valued at $250,000.
Google has since confirmed all three vulnerabilities, fixed them, and paid XBOW its top bounty for the report.
Key points:
- Three then-unknown Chrome bugs were chained into one full exploit
- The attack achieves code execution on Windows from mere page load, with no additional user interaction described
- The exploit was developed in six days using AI agents driven by GPT-5.6 Sol
- Google confirmed and patched all three issues and paid the top bounty
The disclosure highlights how quickly AI-assisted tooling can be applied to vulnerability research, and why keeping Chrome updated matters even when individual bug details are not public.
Source: The Hacker News
Has your organization adjusted patch timelines for browsers in light of AI-accelerated exploit development?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login