XBOW

Security startup XBOW used OpenAI's GPT-5.6 Sol to chain three Chrome zero-days and successfully escape the browser sandbox on Windows.

Four researchers spent six days during Black Hat and DEF CON, with a token bill of about $40,000; the AI agent was responsible for searching code and drafting exploit stages, while humans chose targets and provided context.

Google confirmed the three vulnerabilities, completed the fixes, and paid the top-tier bug bounty of $250,000.

Researchers at the security company XBOW used publicly available AI models to chain three previously unknown Chrome vulnerabilities within six days into a usable complete attack chain.

According to XBOW, the attack was never used against real users before the fixes.

The sprint phase of this attack took place between August 2 and 7, but the team had months of preparation and testing beforehand; the actual cost of the AI models used during those six days was about $40,000.

In this research, AI took on tasks such as retrieving browser source code, validating attack ideas, building prototypes, and writing preliminary reports, while the researchers were responsible for selecting targets, providing direction, and guiding the process.

XBOW's case shows that publicly available AI models are already sufficient to complete high-quality vulnerability research under expert guidance, shortening the time gap between vulnerability discovery and weaponization.

XBOW is a company positioned around AI-driven security testing.

Public information does not state the extent to which XBOW relied on AI and which steps were automated, and attributing the results entirely to AI assistance carries a risk of over-inference.