AI Agents Built a Full Chrome Exploit in Six Days for $40,000

What happened

On October 13, 2026, XBOW, an autonomous offensive security startup, disclosed that its AI agents produced a full-chain exploit for Google Chrome on Windows. The agents did this in six days. They ran on OpenAI’s publicly available GPT-5.6 Sol model — the same version any paying customer can use.

The run happened August 2–7, 2026, during the Black Hat and DEF CON conferences in Las Vegas. The XBOW team included CEO Oege de Moor and researcher Brendan Dolan-Gavitt, with support from Andres Luksenberg, Baul Lee, and Willem Pinckaers. Total compute and API cost: roughly $40,000.

A full chain means escaping Chrome’s renderer sandbox and the V8 sandbox — the layers meant to contain malicious web pages. The final bug sat in Crashpad, Chrome’s crash-reporting component, which runs outside the sandbox. The demo simply loaded a web page and launched the Windows Calculator. Code executed on the machine with no click or download needed.

The three bugs

The chain linked three previously unknown Chrome flaws:

• CVE-2026-85045: a race condition in the V8 JavaScript engine.
• No confirmed public CVE: a bug in the animated WebP image decoder.
• CVE-2026-78952: a bug in Crashpad, Chrome’s crash-reporting component.

Google confirmed the findings, reproduced the chain, and patched all three flaws in August and September 2026. Fixes shipped in the Chrome 152 update. XBOW says the chain was never used against real users. Roughly one billion Chrome users on Windows sat in the potential exposure window. XBOW saw no evidence of real-world exploitation.

The payout

Google paid XBOW $250,000 — the maximum full-chain reward under Chrome’s Vulnerability Reward Program. XBOW says this is the first full-chain reward paid under Google’s revised 2026 VRP rules, which were updated in April 2026. It is also the first ever awarded to an autonomous offensive security platform.

How the agents worked

Humans stayed in the loop. The AI agents searched Chrome’s source code, tested hypotheses, and built exploit pieces. Human researchers picked targets, checked results, and decided how to combine the pieces.

One draft version relied on a bug Google already knew about. The team swapped in a backup WebP bug, and the chain held.

The challenge was first set at a January 2026 staff meeting in Malta. It took months of practice before the six-day success. The headline number — six days — deserves that context: the team had already spent two months building their first full Chrome chain earlier in the year, and the six-day run was the payoff of accumulated tooling and technique.

Speed comparison

Dolan-Gavitt wrote that pre-LLM, a Chrome full chain would take a team of four around six to nine months to produce. XBOW’s first full Chrome chain took two months. The awarded one took six days.

Oege de Moor said: “It only took an estimated $40,000 of compute and six days for a single researcher to produce a chain that previously would have taken months. Attackers are working with this speed and ease, and defenders need a similar pace.”

What this means

The exploit was built by a single researcher directing AI agents. The agents used the same public model any subscriber can access. The cost — $40,000 — is within reach of many well-funded attackers, not just nation-states.

The key takeaway is not that AI is magical. It’s that the barrier to deep, multi-step vulnerability research just dropped dramatically. Six days and $40,000 for a full Chrome chain is a number that changes risk calculations.

For defenders, this creates a pacing problem. Automated bug hunting is no longer a theoretical advantage for attackers — it is demonstrated. Teams that find and patch vulnerabilities now have to keep up with attackers who can run the same playbook. Google’s revised VRP rules, which now explicitly cover autonomous platforms, are one response: rewarding machine-assisted research rather than pretending it doesn’t exist.

For browser users, the practical advice hasn’t changed: keep Chrome updated. These three bugs are fixed in Chrome 152. Check that your browser is on version 152.0.7977.82 or later and that it has actually restarted to apply the update.

The bigger question is what comes next. The underlying approach — AI agents reading source code, forming hypotheses, and testing them — is now proven on one of the hardest targets in software. The next chain may come faster, and it may not land in a press release.

There is also a market effect. When Google hands a $250,000 check to an autonomous security platform, it signals that machine-assisted research is a legitimate, rewarded profession. Expect more startups to follow XBOW’s path: small teams with big models hunting bugs full-time. The Chrome VRP has paid out only a handful of full-chain rewards in its history — Google reportedly hands out at most four such awards a year — which shows how rare these chains were when humans worked alone. If AI compresses the work from months to days, that scarcity will erode. Browser vendors and the rest of the software industry will need to price in a world where deep exploits are found routinely, not rarely.