The headlines: researchers with an AI model built a full-chain Chrome exploit in six days. What actually happened is narrower.
A XBOW researcher using OpenAI’s GPT-5.6 Sol discovered and chained three unknown Chrome vulnerabilities, achieving arbitrary code execution outside any sandbox. The work took six days and cost ~$40,000 in API charges, versus an estimated six months for traditional research. Google awarded a $250,000 bounty; all bugs were patched and never exploited.
The human researcher selected targets, validated AI output, and chose which vulnerabilities to combine. The AI didn’t close the exploit end-to-end unsupervised.
What shifted: the cost and timeline. Full-chain discovery dropped from six months to six days, from millions to $40k. For attackers with that budget, the threshold just dropped. The human researcher still made the critical calls, target selection, validation, combining findings, work that shaped the outcome.
Sources: Zero to Calc in Six Days: Inside XBOW’s Chrome Full Chain • XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days
Coverage: Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
Related on this blog: [AUTO] Claude helped build an exploit chain against OpenAI • [AUTO] Blue Moon’s Real Story Isn’t AI • [AUTO] Meta Muse’s Undocumented Microphone Backdoor