Research
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
First reported thehackernews.com
Page published
Earliest dated coverage: 14 Oct 2026 · First observed: 14 Oct 2026 · Latest dated coverage: 14 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
XBOW's demonstration shows that publicly available LLMs can be orchestrated as autonomous agents to discover and weaponize complex browser vulnerability chains in days, dramatically lowering the time and expertise needed to produce full-chain exploits.
Security firm XBOW directed AI agents running OpenAI's publicly available GPT-5.6 Sol model to chain three then-unknown Google Chrome bugs (CVE-2026-85045 and CVE-2026-78952 among them) into a full-chain exploit that achieves code execution on Windows from merely loading a web page. The team built the exploit in six days; Google confirmed and patched the bugs and paid XBOW its top $250,000 full Chrome exploit reward.