The Pulse
XBOW Built a Chrome Exploit With AI Agents in Six Days
XBOW says a researcher and AI agents built a three-bug Chrome exploit for Windows in six days, earning a $250,000 Google reward. The company says the flaws are fixed and were never used against Chrome users.
AI.info Team · Written with AI ·
A webpage alone could have let an attacker take control of a Windows computer through Chrome, XBOW says. The company announced on October 13 that Google awarded it $250,000 for an exploit chain built with AI agents; it also says Google reproduced the attack and fixed the flaws before they were used against Chrome users. The disclosure puts two facts side by side: the potential reach was vast, but XBOW reports no victims.
A six-day build followed a failed first attempt
XBOW says the awarded chain took six days to build and an estimated $40,000 in computing costs. That clock does not cover the entire project. In a separate account on the company’s blog, founder and CEO Oege de Moor says work began at the start of 2026, with a goal of producing a full-chain Chrome exploit by the Black Hat cybersecurity conference in August.
The first chain the team assembled did not qualify: Google told XBOW it already knew about one of the bugs. The researchers had built the attack from three parts, each with an alternative, which let them replace the disqualified bug rather than start over. XBOW says researcher Brendan Dolan-Gavitt and AI agents built the replacement from August 2 to August 7 in Las Vegas.
Four researchers—Dolan-Gavitt, Andres Luksenberg, Baul Lee and Willem Pinckaers—took on the broader project, working with OpenAI’s GPT-5.6 Sol and earlier versions. XBOW describes the six-day replacement work as one researcher collaborating with agents. The distinction matters: the company’s account does not describe a fully autonomous system discovering and assembling the exploit on its own.
“Separate, perhaps even low-severity, vulnerabilities can now be chained together into a high-severity exploit path,”
Oege de Moor, founder and CEO of XBOW
Three bugs broke through Chrome’s layers
XBOW says the chain crossed two sandbox boundaries in three stages. A bug in V8, Chrome’s JavaScript engine, gave an attacker control of memory inside the engine’s sandbox. A flaw in the animated-WebP image decoder then enabled an escape from that sandbox, and a third bug in Crashpad, Chrome’s crash handler, led to code execution outside the browser’s confinement.
The final step is what turned separate software flaws into a full-chain exploit: a program could run outside Chrome’s sandbox after a user simply loaded a webpage, according to XBOW. The company says that access could let an attacker install malware or spyware, steal files or credentials, or use the compromised machine as a foothold for further attacks.
XBOW estimates that before the fixes, the affected class of flaw put about one billion people running Chrome on Windows in the potential attack path. That figure describes possible exposure, not a count of compromised users. The company says Google’s engineers reproduced the exploit, confirmed the bugs and shipped fixes, and that the vulnerabilities were never used against Chrome users.
Humans chose the path; agents tested it
XBOW says its agents searched Chrome’s source code, tested ideas, built proofs of concept and drafted early versions of the exploit. Researchers chose where to focus, assessed the agents’ results and redirected their work. The company attributes the outcome to that division of labor, rather than to the model acting independently.
OpenAI’s Head of Cyber Research, Clint Gibler, said in XBOW’s announcement that one researcher used OpenAI’s models to find a chain Google had fixed. De Moor argues that defenders should use similar tools to find exploitable paths in their own software. XBOW says it plans to put the reward toward security work for nonprofit organizations and is developing a product to test compiled software, including desktop applications, servers and embedded devices.
For Chrome users, XBOW’s practical advice is to install browser updates and relaunch Chrome when prompted: the company says fixes take effect only after the browser restarts. The company’s announcement frames the exploit as evidence that vulnerability research can move faster with AI assistance, while its own project history shows the six-day result depended on earlier work, human direction and a backup plan when Google had already identified a flaw.