AI Agents Built a Chrome Zero-Day in Six Days: Inside XBOW's $250K Google Bounty

What Happened: A Full Chrome Exploit Chain, Mostly Machine-Made

On October 13, security firm XBOW published a disclosure that reframes what "AI-assisted security research" means: between August 2 and August 7, 2026, researcher Brendan Dolan-Gavitt and a team of AI agents built a full-chain zero-day exploit for Chrome — a chain capable of running code on a Windows machine from nothing more than a victim visiting a malicious webpage. Google verified the chain, patched all three vulnerabilities used, and paid out its $250,000 top-tier Chrome bounty, approved by the vulnerability rewards panel on August 31.

The detail that stopped the industry cold: the agents ran on OpenAI's publicly available GPT-5.6 Sol model — not a private, government-grade system — and consumed roughly $40,000 of compute over six days. No nation-state budget, no zero-day broker, no decade of exploit-dev apprenticeship. A frontier model, a skilled operator, and a week.

XBOW builds AI-driven offensive security tooling that hunts for exploitable weaknesses, and this project extended its playbook from web applications to Chrome itself — a target whose layered sandbox architecture exists precisely to stop compromised web content from reaching the operating system underneath.

How the Three-Bug Chain Broke Chrome's Sandboxes

Full-chain browser exploits are the hardest artifacts in consumer security. They require chaining multiple independent bugs to escape every layer of defense between rendered web content and the host OS. XBOW's chain stitched together three:

• Stage 1 — V8's Maglev compiler: a flaw in Chrome's optimizing JavaScript compiler gave the exploit access to memory inside the V8 engine's sandbox.
• Stage 2 — animated WebP decoder (CVE-2026-85045): by mutating image data after the decoder had cached its dimensions, the agents produced a write outside the V8 sandbox — crossing the first major boundary.
• Stage 3 — Crashpad: the crash-reporting component runs outside the renderer sandbox; a faulty memory-read retry could overflow a buffer when memory protections changed between reads, yielding code execution in the crash handler itself.

The proof-of-concept launched Windows Calculator from a webpage in Chrome Beta — the traditional, slightly cheeky demo. In real use, execution outside the browser sandbox means file access, credential theft, and malware installation. Google has patched all three bugs; if you use Chrome and haven't restarted your browser since the updates rolled out, do that today.

Notably, the team designed the stages to be interchangeable, with backup vulnerabilities prepared for each position in the chain — so when one bug turned out to have been reported by someone else already, an agent-built replacement slotted straight in.

$40K of Compute vs. $250K (and the $1.5M Gray Market)

The economics deserve their own headline. Six days and $40,000 of compute produced an artifact that Google values at $250,000 — and that exploit brokers like Crowdfense publicly advertise at up to $1.5 million for desktop Chrome zero-day chains, six times Google's award.

That gap is the whole story of offensive AI in one sentence. Every incentive structure in the vulnerability market assumes that full-chain exploits are scarce, expensive, and the product of rare human expertise. When a frontier model plus a week of guided agent work can produce one, the scarcity assumption breaks — for defenders and buyers on both sides of the market.

XBOW itself is careful about the claim: the company predicts agents could independently discover similar bugs within a year, and readily admits that prediction remains unproven. This chain was expert-led. But "expert-led" now means directing the work, not typing the exploit.

The Human Role: Direction, Not Grunt Work

According to the disclosure, the division of labor looked like this: AI agents searched source code, tested hypotheses, developed proofs of concept, and drafted exploit components. Humans selected targets, checked results, and redirected the work when a path went cold.

That's the same shape agentic coding took across 2026 — from Claude Code to OpenAI's Codex — applied to one of the most technical domains in software. The human is an architect and editor; the model is the tireless junior exploit engineer who never sleeps, never gets bored reading V8 source, and can test a hundred dead-end hypotheses in parallel.

It also continues a streak: XBOW topped HackerOne's US leaderboard in 2025 with its autonomous penetration-testing agent, and GPT-5.6-class models have been closing benchmark gaps on vulnerability discovery all year. The Chrome chain is the most consequential public proof point yet that offensive capability is riding the same curve as coding capability.

Why This Matters for Security Teams and AI Tooling

If you build, buy, or defend software, three implications stand out:

• Attack surface moves at model speed now. The time from "model capable of X" to "X deployed in the wild" is collapsing. Patch latency — browser relaunch included — becomes a first-order risk metric.
• Fuzzing and static analysis need an agentic upgrade. If offense is agentic, defense has to be. Expect demand to surge for AI-driven continuous scanning and remediation tools, the defensive mirror of what XBOW built for offense.
• The talent bottleneck shifts again. Scarcity moves from "can find the bug" to "can direct, verify, and safely handle an agent that finds the bug." Verification skill — being able to check an agent's exploit actually works and is safely disclosed — is the new senior skill.

There's a governance angle too. The same week, the EU opened its first AI Act probes and 400+ scientists called for air-gapped frontier model testing. A publicly available model assembling a Chrome full-chain for $40K is exactly the kind of datapoint that turns abstract "capability risk" debates concrete.

AI Security and Coding Tools to Watch

The models and agents in this story are commercially available, and the defensive category is growing fast. On aitrove.ai's AI coding tools directory you can compare the agentic platforms doing this class of work:

• Agentic coding platforms like OpenAI's GPT-5.5 family and Codex 3.0 — the same model lineage (GPT-5.6 Sol is a sibling) that powered XBOW's agents.
• AI code security tools like Snyk AI — the scanning-and-fixing side of the equation for teams absorbing agent-written code.
• AI safety and guardrails platforms such as Protect AI and Arthur AI, which monitor what agentic systems actually do in production.

Whichever side of the offense-defense line you sit on, the tooling curve is the same one — and it just got a very public proof of speed.

Frequently Asked Questions