Generated by Codex with GPT 5.6 Sol High

TBPN’s October 13 episode surfaced Oege de Moor’s account of an unusually concrete milestone in AI-assisted offensive security: XBOW says researchers working with agents built a new Chrome exploit chain in six days. The company published both a high-level announcement, “XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days,” and a detailed technical reconstruction. Google accepted the chain into its vulnerability reward program, confirmed that it launched Calculator outside Chrome’s renderer sandbox, and paid the first \$250,000 full-chain reward under rules introduced in April 2026.

This was not an autonomous model typing “hack Chrome” and returning a finished weapon. Nor was it merely an impressive benchmark. The result sits in the more consequential middle: AI agents using the publicly available GPT-5.6 Sol model did most of the source search, hypothesis testing, proof-of-concept construction, and exploit-stage development, while experienced researchers chose the targets, supplied techniques, challenged results, and decided how to join the pieces. That combination compressed a task XBOW estimates once required a four-person team for six to nine months into less than a week.

Three broken assumptions, one complete escape

Chrome deliberately surrounds hostile web content with multiple boundaries. Even after corrupting memory in its JavaScript engine, an attacker must escape V8’s in-process sandbox. Native code inside the renderer remains trapped behind a second operating-system sandbox. A full chain crosses all of those layers, turning an ordinary web page into code execution on the host computer.

XBOW’s technical report describes three previously unknown vulnerabilities, each built around data that one component treated as stable even though another could still change it.

The first bug was in Maglev, V8’s optimizing compiler. During deoptimization—the process of reconstructing ordinary JavaScript objects after an optimization assumption fails—Maglev could reuse one mutable boxed number across objects as though it were an immutable constant. By changing the shared number between two compiler observations, the exploit made one check approve a safe array index while another used a different offset. That mismatch produced read-and-write access throughout V8’s four-gigabyte pointer-compression region.

The second stage escaped that region through Chrome’s animated WebP decoder. JavaScript normally loses access to an ArrayBuffer after transferring it to an image decoder, so Blink treated the bytes as exclusively owned and stable. The first-stage memory primitive let the exploit retain a working view anyway. It supplied one valid WebP when the decoder cached frame geometry, then replaced the bytes with a different valid WebP before decoding. Combining the first file’s dimensions with the second file’s payload caused a native heap overflow that XBOW shaped into one chosen 64-bit write outside the V8 sandbox.

The final stage attacked Crashpad, Chrome’s crash handler, which runs outside the renderer sandbox. Crashpad suspends a renderer before reading its memory and assumed the stopped process could not change a page between a failed read and a retry. Windows, however, permits a specially created thread to bypass process freezing. That thread changed page protections at exactly the wrong moment, causing Crashpad to copy more bytes than its destination buffer could hold. The overflow rewired a live crash-report writer and ultimately launched Calculator on Windows, demonstrating host-level code execution.

Google has fixed all three bugs. The practical user advice is simple: Chrome’s automatic download does not activate a fix until the browser restarts, so relaunch promptly when an update is ready.

The orchestration mattered as much as the model

XBOW did not assign the entire problem to one long-running agent. It split the campaign into parallel tracks for general vulnerability discovery, V8 corruption, two successive sandbox escapes, and final integration. Each stage exposed a clean interface to the next, and the researchers developed backup routes.

That modularity saved the attempt. Google’s reviewers said one bug in XBOW’s first proposed chain was already known, which made the submission ineligible for the full reward. Because the researchers had separated the stages, they could replace the middle escape with the WebP vulnerability during Black Hat and DEF CON rather than rebuild everything. AI supplied search breadth and iteration speed; humans supplied decomposition, skepticism, prior exploit patterns, and the judgment to prepare for bug collisions.

XBOW reconstructed roughly \$40,000 in API charges from archived agent logs. The spend is small beside the bounty and the value of a Chrome chain, but it is not proof that anyone with the same budget could repeat the result. The team brought deep browser-security expertise and examples of techniques its own researchers had already invented. The comparison with six-to-nine-month pre-LLM projects is also the company’s estimate, not a controlled experiment, and the disclosure offers no baseline run by the same team without agents.

Faster discovery changes both sides of defense

The strongest conclusion is narrower than XBOW’s claim that fully autonomous discovery of all three bugs may be a year away. This episode shows that a public frontier model, wrapped in a capable agent system and directed by experts, can materially accelerate the construction of a real, rewarded exploit against one of the world’s most hardened consumer programs. It does not establish the model’s independent success rate, how much of the six-day speedup came from reuse of earlier work, or whether the method generalizes across targets.

It still changes the economics. Attackers can search more hypotheses, combine individually modest bugs, and rebuild a chain when one component fails. Defenders have the compensating advantage of testing their own code before release, but only if they use the same tools and shorten patch cycles. The relevant response is not confidence that layered sandboxes will stop every chain, or panic that every model user can now compromise Chrome. It is to treat the assumptions connecting those layers—ownership, immutability, suspension, and trusted interfaces—as first-class attack surfaces, then continuously test whether they remain true under adversarial mutation.