Google paid $250,000 after researchers used OpenAI’s AI to break Chrome’s security

Google has paid security firm XBOW $250,000 after its researchers used OpenAI's GPT-5.6 Sol to help build a Chrome exploit that could take control of a Windows PC from a malicious webpage. The researchers reported the bugs to Google, which confirmed and fixed them before the details were made public.

The work shows how AI agents can change the economics of security research. XBOW says one researcher working with the agents built the final attack chain in six days, from August 2 through August 7, with about $40,000 in model compute. The result was eligible for Google's $250,000 Chrome full-chain reward.

XBOW estimated that the exploit could have affected about one billion Windows Chrome users.

AI helped dramatically shorten the path to creating a working Chrome exploit

XBOW's researchers were not simply asking the AI model to write attack code. Instead, the agents searched Chrome's source code, tested possible vulnerabilities, built proofs of concept, and produced early exploit code. The human researchers chose the targets, reviewed the results, and decided how the pieces should fit together.

XBOW said it deliberately used GPT-5.6 Sol, a publicly available OpenAI model, and not a specialized security system. The company chose the model because it was available to anyone rather than restricted to XBOW researchers.

The team first built a different exploit chain, but Google informed the company that one of the bugs was already known. XBOW researchers then used an alternate vulnerability and completed a new chain during the six-day period.

According to XBOW, similar Chrome full-chain work could have previously taken their team months. AI helped them compress the research process that normally would have involved extensive manual testing and debugging.

The Chrome bugs were fixed before attackers could exploit them

The exploit combined three separate Chrome flaws to cross the browser's security boundaries, with the first involving V8, Chrome's JavaScript engine. A second flaw affected the animated WebP image decoder, while a third flaw involved Crashpad, Chrome's crash-handling system.

Chrome uses sandboxing to isolate webpage code from the rest of the computer, so a successful browser exploit would still have a barrier it would need to cross before it could affect the operating system. This chain was designed to cross these barriers in sequence.

Together, the bugs could move an attacker from code running inside a webpage to code running outside Chrome's sandbox on Windows. This meant a victim could be compromised simply by loading a malicious webpage, without downloading a file or clicking a button.

Google confirmed the vulnerabilities and released the fixes in Chrome's August and September updates. XBOW says the chain was never used against Chrome users, and the research was a security demonstration rather than a known attack in the wild.

The $250,000 bounty could shape the future of AI-assisted hacking

According to Google Bug Hunters, the Chrome Vulnerability Reward Program offers a $250,000 bonus for an eligible full-chain exploit against a current Chrome release. Google says it will reward a maximum of four such exploit bonuses in 2026. XBOW's payout was the first Chrome full-chain award under the updated 2026 rules.

The company says the research showed a more practical use for public AI models, which accelerate offensive security research while also helping defenders find weaknesses before attackers do.

For Chrome users, the lesson is to ensure their browser is updated to the latest Chrome releases. The bugs described by XBOW have been fixed, so the research is now more of a glimpse at how quickly AI-assisted security testing is evolving and what companies can do to keep up.

Sources: XBOW, The Hacker News, Google Bug Hunters

Affiliate links on Cult of Mac may earn us and our partners a commission.