Research
Security researchers spent 6 days doing their Chromework, built 1B user exploit
First reported theregister.com
Page published
Earliest dated coverage: 14 Oct 2026 · First observed: 14 Oct 2026 · Latest dated coverage: 14 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Xbow's AI-agent-assisted discovery of a full Chrome sandbox-escape chain in six days demonstrates how LLM-driven agents can dramatically compress the time and cost of finding and weaponizing zero-day vulnerabilities at scale.
Security startup Xbow used OpenAI's GPT-5.6 Sol model and AI agents to chain three Chrome zero-day vulnerabilities into a full-chain exploit capable of executing code outside the browser's sandbox on Windows, potentially affecting around a billion users. The agents searched source code, tested hypotheses, and built proofs of concept while humans chose targets and chained components; Google fixed all three bugs and paid a $250,000 bounty.