Xbow Uses GPT-5.6 Sol to Break Chrome for $40K in Compute
Cybersecurity firm Xbow spent $40,000 using OpenAI’s GPT-5.6 Sol to uncover critical Google Chrome vulnerabilities, earning a $250,000 bounty and demonstrating AI's power in threat discovery.
Security researchers at Xbow USA have demonstrated the growing power of general-purpose artificial intelligence in software threat hunting by utilizing OpenAI’s GPT-5.6 Sol model to uncover a critical exploit chain within Google’s Chrome web browser. Over the course of a six-day research effort requiring just $40,000 in AI compute resources, the team assembled a functional exploit that could have potentially enabled malicious actors to gain full control over as many as one billion Windows devices worldwide.
The successful demonstration earned Xbow a $250,000 bug bounty payout from Google, marking the very first reward granted under the technology giant's updated 2026 rules. The researchers intentionally selected OpenAI’s publicly available GPT-5.6 Sol model rather than relying on specialized internal security tooling. Their goal was to showcase what standard commercial AI systems can accomplish when guided by experienced human threat analysts during software audits.
Throughout the project, human researchers maintained strategic oversight, decided where to investigate, and reviewed all output. GPT-5.6 Sol handled the labor-intensive tasks, such as searching Chrome’s massive source code repository, evaluating potential flaw theories, and writing initial proofs of concept. Using this approach, the team successfully escaped the V8 JavaScript engine sandbox before breaking Chrome’s operating-system process sandbox, allowing them to execute a Windows application via a malicious web page.
After confirming the exploit chain, Xbow presented its findings directly to Google, which subsequently patched the underlying vulnerabilities, and detailed the development process in an official blog post. For enterprise security teams and software practitioners, this project illustrates how off-the-shelf AI models can drastically compress vulnerability research timelines and reduce costs, fundamentally altering both offensive testing methodologies and defensive patch priorities.
This is our own summary of reporting by Computerworld AI
