Xbow USA Exploits Chrome With $40,000 in AI Compute, Wins $250,000 Google Bounty
Updated
Updated · Computerworld · Oct 16
Xbow USA Exploits Chrome With $40,000 in AI Compute, Wins $250,000 Google Bounty
1 articles · Updated · Computerworld · Oct 16
Summary
$40,000 in AI compute and six days of work let Xbow USA build a Chrome exploit chain that could have handed control of roughly 1 billion Windows machines to attackers.
Using OpenAI's GPT-5.6 Sol, the researchers searched Chrome's code, tested ideas and built proof-of-concept pieces, while the human team chose targets, set strategy and verified results.
The chain escaped both the V8 JavaScript sandbox and Chrome's operating-system process sandbox, ultimately launching a Windows app from a malicious web page.
Google fixed the flaws after Xbow disclosed them, and paid a $250,000 reward — the first bounty issued under its new 2026 rules.
If $40,000 of AI compute yields a $250,000 bounty, will automated exploit hunting become the next gold rush for hackers?
With AI accelerating zero-day discovery, how can enterprise security survive when malicious actors weaponize similar AI-driven exploit chains?
The $40,000 Chrome Hack: How AI-Powered Exploits Are Forcing a Security Revolution in 2026
Overview
In August 2026, XBOW researcher Brendan Dolan-Gavitt and GPT-5.6 Sol AI agents rapidly developed a full-chain Chrome exploit on Windows in just six days, costing about $40,000. XBOW responsibly disclosed the vulnerabilities to Google, who then awarded them a $250,000 bug bounty. When Google revealed that one bug was already known, XBOW’s modular exploit design allowed AI agents to quickly swap in a backup vulnerability, ensuring a valid submission. Google verified the proof-of-concept and released patches, but the speed of AI-driven vulnerability discovery has since forced major vendors like Mozilla, Microsoft, and Oracle to accelerate their security update cycles.