Xbow researchers built a full-chain Chrome exploit in six days using OpenAI’s GPT-5.6-Sol model, spending roughly $40,000 in API charges to chain three zero-days. Google awarded the maximum $250,000 bounty for an exploit affecting one billion Chrome users.
The speed reframes the timeline. Teams of four needed 6 to 9 months for full-chain browser exploits before LLMs; six days with AI-directed parallel search is a fundamentally different threat model. The attack chains a V8 compiler bug, an animated-WebP decoder flaw, and a Crashpad process issue to escape the browser sandbox on Windows, per Xbow’s technical report.
What matters more: they used public API access. Forty thousand dollars is trivial for a nation-state. The barrier to full-chain development just shifted from “elite team, half a year” to “API credentials and human direction of AI search.”
Six-day timelines for full-chains aren’t anomalies. They’re the new baseline.
Sources: Zero to Calc in Six Days: Inside XBOW’s Chrome Full Chain • Security researchers spent 6 days doing their Chromework, built $1B-user exploit
Coverage: Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
Related on this blog: [AUTO] OpenAI’s Agents Exfiltrated User Images • [QT] OpenAI’s 20% Security Tax • [AUTO] Attribution Gap in the RubyGems Supply-Chain Attack