Researchers used OpenAI to build a $250,000 Chrome exploit in six days

Key takeaways

• XBOW used AI agents running GPT-5.6 Sol to discover and chain three zero-day Chrome bugs into a remote-code-execution exploit in six days.
• Google patched all three vulnerabilities and awarded XBOW its top bug bounty of $250,000.
• The AI agents operated with publicly available models, meaning both security researchers and attackers have access to the same tools.
• This changes the economics of vulnerability research, collapsing timelines from months to days.
• AI agents amplify skilled researchers but still require human direction, validation, and ethical disclosure practices.

# Researchers used OpenAI to build a $250,000 Chrome exploit in six days

What shipped

On October 14, security firm XBOW disclosed (https://thehackernews.com/2026/10/researchers-used-public-openai-model-to.html) that its researchers discovered three previously unknown vulnerabilities in Google Chrome and chained them into a single exploit capable of remote code execution. The attack works when a user simply loads a malicious web page on Windows. No clicks, no downloads, just visit the page and the attacker can run code on your machine.

The team built this full-chain exploit in six days by directing AI agents powered by OpenAI's publicly available GPT-5.6 Sol model. Google confirmed all three bugs, patched them, and awarded XBOW its top bug bounty of $250,000.

This is the first publicly documented case of AI agents autonomously discovering and chaining multiple zero-day vulnerabilities into a working exploit. Zero-day means the bugs were unknown to the vendor and the public before XBOW found them.

How it works

XBOW used what the industry calls "AI agents" to search for vulnerabilities. An AI agent is a language model given tools and the ability to make decisions over multiple steps. Think of it as the difference between asking ChatGPT a single question versus giving it access to a debugger, a compiler, and instructions to keep probing until it finds something.

The researchers pointed these agents at Chrome's enormous codebase. The agents analyzed code, identified suspicious patterns, generated test cases, and iterated on potential exploits. When one bug was found, the agents explored how to chain it with others to escalate privileges or achieve code execution.

The specific technical details of the three Chrome bugs have not been published, which is standard practice until patches are widely deployed. What matters is the method: the AI agents operated with a level of autonomy and speed that would be difficult for a human team to match in the same timeframe.

GPT-5.6 Sol is a publicly available model. XBOW did not need proprietary tools or insider access. They used the same API any developer or researcher can access today.

What it changes for builders

This changes the economics and timeline of vulnerability research. Six days is fast. A typical bug bounty hunter might spend weeks or months hunting for a single high-value bug. Chaining three together into a full remote-code-execution exploit is expert-level work.

If AI agents can collapse that timeline, two things happen. First, the good guys (security researchers and internal red teams) can find and fix bugs faster. Second, the bad guys get the same capability. The model XBOW used is public. The techniques they refined will spread.

For anyone building software, this means your exposure window is shrinking. Bugs that might have stayed hidden for months could be discovered in days. Your internal testing needs to assume adversaries have access to the same AI tools you do.

For security teams, this is a forcing function. You cannot rely on obscurity or the assumption that finding complex bugs is hard. It is getting easier and faster.

Gotchas and limits

AI agents are not magic. They need direction, constraints, and verification. XBOW's researchers were guiding the agents, interpreting results, and validating findings. The agents did not operate in a vacuum. They are tools, not replacements for skilled humans.

The six-day timeline is impressive, but it does not mean every exploit can be built that fast. Chrome is a high-value target with a massive attack surface and a well-funded bug bounty program. Smaller codebases or less common software might not yield results as quickly. Our read is that AI agents amplify researcher skill and focus rather than eliminate the need for either.

There is also a disclosure and ethics question. XBOW followed responsible disclosure: they reported the bugs to Google, waited for patches, and only published after fixes were live. Not everyone will follow that path. As these tools become more accessible, the risk of exploit discovery outpacing patch deployment grows.

Finally, this was done with a public model. We do not yet know how much further private or fine-tuned models might go. If GPT-5.6 Sol can do this, what happens when someone trains an agent specifically on exploit development?

How we would use it

At 21 Arrows, we would use AI-assisted vulnerability research in two ways. First, as part of internal security audits for custom software we build. Running AI agents against our own code before deployment lets us find and fix issues before they reach production. Second, as a red-team exercise for clients who want to stress-test their applications.

We would not rely solely on AI findings. Every flagged issue needs human review to confirm it is real, assess business impact, and determine remediation priority. False positives are common in automated security tools, and AI agents are no exception.

We would also use this as a planning signal. If AI can find bugs this fast, we need to design systems with the assumption that any vulnerability will be discovered quickly. That means defense in depth, monitoring for exploitation attempts, and a patch process that can move in days, not weeks.

The takeaway is not that AI is coming for security jobs. It is that the pace of offense and defense just accelerated, and everyone building or operating software needs to adjust their expectations and timelines accordingly.