Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

Summary

XBOW researchers chained three previously unknown Google Chrome bugs into a full-chain exploit that runs code on a Windows computer when a user only loads a web page. They built it in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model, and Google fixed all three bugs and paid XBOW a $250,000 reward.

Mitigation

Relaunch Chrome and confirm the version is 152.0.7977.82 or later. Chrome updates automatically, but the fix only takes effect after the browser restarts.

Related items

• InfoNvidia, worth $5.5tn, donates $250m to UK for AI safety researchSame vendor · The Guardian Technology
• MediumAI agents aren’t ‘going rogue.’ Frontier labs are skipping security basics.Same vendor · CSO Online
• LowOpenAI’s AI misalignment problem is growingSame vendor · CSO Online
• InfoGoogle DeepMind and Singapore Government collaborate to build fine-tuned AI model for scam detectionSame vendor · DeepMind Safety Research
• InfoOpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference RoomSame vendor · The Hacker News