Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

Security firm XBOW used OpenAI's publicly available GPT-5.6 Sol model to construct a full-chain Chrome exploit within six days. The attack chained three previously unknown Google Chrome vulnerabilities into a single exploit capable of executing arbitrary code on a Windows machine when a user visits a malicious web page. The exploit required no additional user interaction beyond loading the page. Google confirmed all three bugs, patched them, and paid XBOW its top bug bounty reward of $250,000. This research demonstrates a significant advancement in AI-assisted vulnerability discovery and exploit development. The use of AI agents to automate exploit chaining raises serious concerns about the democratization of advanced offensive security capabilities and the accelerating pace at which zero-day exploits can be developed.