XBOW turns GPT-5.6 Sol into a $250,000 Chrome full-chain in six days

Six days, roughly forty thousand dollars in API charges, and a public OpenAI model. That is the package XBOW sold the industry on 13 October 2026, after Google paid the company the top Chrome Vulnerability Reward Programme cheque for a Windows full chain. The package is real enough to force a patch. The word “autonomous” still asks for more than the documents deliver.

Malta set the challenge; Las Vegas delivered the six-day sprint

At a January 2026 all-hands in Malta, XBOW founder Oege de Moor told the team to take the company’s offensive-agent work beyond web apps and aim it at desktop software. Chrome full-chain was the target. Black Hat and DEF CON in August were the deadline.

The company says an earlier internal Chrome chain had already taken about two months. Then, between Sunday 2 August and Friday 7 August 2026, Distinguished Engineer Brendan Dolan-Gavitt and agents running OpenAI’s publicly available GPT-5.6 Sol rebuilt a fresh three-stage chain while the Las Vegas conference week was underway. On 13 October, XBOW published the award announcement and a Labs root-cause write-up. The Hacker News and Forbes Wiretap carried the story into a 13–14 October wave.

Three fixed bugs, two CVEs, and a Gin collision that nearly killed the chain

Google paid for a three-stage path that, in XBOW’s telling, crossed both of Chrome’s nested sandboxes from an ordinary web page to code running outside the renderer on Windows.

At a level already public in the company’s posts and in Chromium’s stable notes, the awarded path started in V8, Chrome’s JavaScript engine, with memory control inside the engine’s sandbox. A bug in the animated-WebP image decoder turned that into a single precise write outside that cage. A bug in Crashpad, the crash handler that runs outside the renderer sandbox, turned the write into full code execution. XBOW’s demonstration video shows Calculator launching from signed Chrome Beta. The company says the bugs were reported through Google’s official programme, reproduced by Google, fixed before the October disclosure, and never used against Chrome users.

Two of those stages now carry public CVE identifiers that Chromium itself credits to Dolan-Gavitt of XBOW. CVE-2026-78952, a high-severity out-of-bounds write in Crashpad, was reported on 13 August 2026 and fixed in the 25 August desktop Stable update that shipped Chrome 152.0.7977.65. CVE-2026-85045, a high-severity race condition in V8, was reported on 17 August and fixed in the 3 September desktop Stable update at 152.0.7977.82. The Hacker News notes that XBOW’s award post attached CVE-2026-85045 to the WebP stage; Google’s notes and XBOW’s own Labs post both place that identifier on V8. The WebP stage was fixed in the same Chrome 152 cycle, but a confirmed public CVE for it was still missing from the secondary record THN could verify.

The sprint’s most useful operational detail sits one layer above the root causes: a near miss. XBOW says it built the chain as swappable stages with backups because LLM-era reporters collide on the same Chromium bugs. The first version used a Gin-based V8 sandbox escape that turned out to duplicate Chromium issue 542670566. After what Dolan-Gavitt calls a stressful few hours, the team swapped in the animated-WebP stage and Google confirmed the revised chain. Without modular interfaces, the six-day story ends as another duplicate.

XBOW is also unusually explicit, for a vendor that brands itself around autonomy, about who did what. Agents searched source, tested ideas, built proofs of concept, and drafted exploit stages. Researchers chose targets, supplied context, challenged results, redirected searches, and decided which components to join. Dolan-Gavitt’s own comparison frames the speed: a pre-LLM Chrome full chain might take a team of four around six to nine months; XBOW’s first submission took two months; the awarded one took six days. Reconstructing Codex usage logs, the company puts the August campaign at roughly $40,000 in API charges.

Google shipped the fixes; OpenAI claimed a defender win

By the time XBOW briefed the press, the Stable channel had already absorbed the identified Crashpad and V8 fixes. The Hacker News guidance is the ordinary Chrome one: the browser updates itself, but a fix only applies after relaunch, so operators should confirm they are on 152.0.7977.82 or later.

OpenAI’s Head of Cyber Research, Clint Gibler, appears in XBOW’s announcement praising a single researcher’s use of the company’s models to uncover a chain Google has now fixed, and promising work to put similar capabilities in more defenders’ hands. Gibler’s line puts OpenAI on the coordinated-disclosure side of the story. How much of the chain the model produced without human redirection remains unaudited in public.

XBOW says it will put the award money toward securing NGOs with its technology. De Moor’s public line is urgency without panic: the model used is already public, so restricting access is the wrong question; defenders should test their own software first because they can.

Chrome’s 2026 full-chain VRP pays $250,000 and caps the class

Google’s Chrome Vulnerability Reward Programme, under rules updated in 2026, pays up to $250,000 for a full-chain exploit, the top single-report tier in that programme. Secondary reporting says Google awards at most four such full-chain bounties a year. XBOW calls this the first full-chain Chrome reward under the 2026 rules and the first granted to an autonomous offensive security company. The cheque turns on the first claim. The second is branding.

The legal and ethical boundary that actually constrained this story is the boring one. XBOW reported through the official channel, waited for fixes, and published root-cause material after the Stable updates. That is how a $250,000 research sprint stays a research sprint. Readers who only need an action item can skip the Labs post and confirm a current Chrome build, then restart.

XBOW’s write-up still needs a human stitch

Several claims travel with the award and should be priced carefully.

XBOW’s corporate identity is “autonomous offensive security.” Its own technical account describes a human selecting campaigns, challenging agent output, and stitching modular stages, including the Gin-to-WebP rescue that saved the bounty. A public model in the loop is news. The documents stop short of an unsupervised agent that prints a Chrome full chain on its own.

Dolan-Gavitt warns that six days and $40,000 is not much when the payoff is a Chrome chain, and that the bar is lower. In the same breath he says the result required human expertise and judgment. Read the cost figure as a reconstructed spend for this campaign, not a kit price for any buyer with an API key.

The “billion Chrome-on-Windows users” line is XBOW’s estimate of who sat in the path of this class of flaw before the fixes. Treat it as a scale claim about exposure. No in-the-wild exploitation is claimed in the materials reviewed for this piece.

If your briefing deck still maps CVE-2026-85045 to WebP because the award post did, correct it against Chromium’s Stable notes. The V8 and Crashpad IDs are clear. The WebP public CVE remains the soft edge of the public record.

De Moor’s forward claim that within a year each of the three bugs could be found by agents working alone sits in the blog as founder speculation. No measured eval with methods accompanies it in the public materials.

Until Unprompted and a public WebP ID land, price the orchestration carefully

For security teams, the Monday move is concrete. Confirm Chrome is past the September Stable floor, restart so the update is live, and treat public frontier models as available to anyone who already knew how to aim them. Collision risk is now part of bug-bounty planning: if your chain is not modular, a duplicate mid-sprint can erase weeks.

For buyers and policymakers hearing “autonomous offense” in the same sentence as a quarter-million-dollar Google cheque, ask who chose the targets, who rejected dead ends, and what happened when a stage collided. XBOW says it will unpack chronology and orchestration at Unprompted at the end of October. Until that talk, a public WebP CVE identifier, or an outsider reproduction, the established story remains a human-directed agent campaign that earned a top VRP award after Google shipped fixes. Commodity API full chains are still a claim waiting on evidence.

What travels from this disclosure is the lowered time and money bar for people who already know how to aim the work, and the collision tax that modular stages are meant to absorb.