Greg Brockman says XBOW, using GPT-5.6 Sol, built a full-chain Chrome exploit in 6 days for about $40,000 of compute.
Google awarded a $250,000 bounty, the first under its 2026 rules, for the exploit, which the post says could affect about 1 billion Chrome users on Windows.
Brockman says defenders should test their own code first, and XBOW is developing an autonomous product for testing compiled software.
The post gives a concrete figure for cost and time to build a Chrome exploit, useful for judging how AI changes vulnerability discovery.
6 days and $40,000 of compute with GPT-5.6 Sol to find a critical vulnerability in Chrome, claiming Google’s first full-chain reward in 2026 for a vulnerability that would affect an estimated 1 billion users.
Highlights the opportunity for defenders to utilize these tools to secure their software to unprecedented levels:
For the second time in Google Chrome’s history, Google awarded a $250,000 bounty for a full-chain exploit… to @XBOW. Here’s the full story: At an all-hands at the start of 2026 in Malta, I set the team a crazy challenge. A full-chain exploit of Chrome by the annual Black Hat cybersecurity conference in August. I believed there were few better tests of whether @XBOW could move beyond web applications to desktop software, servers and devices. Chrome is one of the most hardened pieces of software on the planet, used by more than half the world’s population. A full-chain exploit lets an attacker take total control of a machine, where they can read every email, password and bank login the user types. You don’t need to download anything or click a phishing link. Visiting the wrong site is enough. So @moyix, Andres Luksenberg, Baul Lee, and Willem Pinckaers took on the challenge along with a fifth teammate: OpenAI's GPT-5.6 Sol. They built a chain they thought would win, but Google told us they already knew one of the bugs. We were already in Las Vegas for Black Hat and DEF CON, and the team didn’t want to go home without the win. So Brendan and the agents built a new exploit in just 6 days. We submitted it to Google and waited. The news came through that we'd done what should’ve been impossible. A full-chain bounty of $250,000, the first awarded under Google’s 2026 rules. It took just 6 days and $40,000 of compute to construct an exploit that affects a billion users of Chrome on Windows. An intelligence-agency veteran told me his team used to spend 6 months on this kind of vulnerability. My takeaway: the cost of finding truly critical vulnerabilities is collapsing, for attackers and defenders alike. Restricting powerful models is not the answer; GPT-5.6 Sol is already public. But defenders have one advantage attackers never will: they can test their own code first. Assume your software is exploitable. Whoever is hunting your bugs has the same building blocks we did. This is cause for urgency but not panic. XBOW is now developing an autonomous product for testing compiled software (desktop applications, servers, embedded devices), and partnering with the world’s top organizations to design that product. If you’d like to be one of them, get in touch. P.S. Restart Chrome whenever the Update button appears!
Source: Greg Brockman · x.comPublished · added here
