Google pays $250k to XBOW for a Chrome exploit built with GPT-5.6 Sol Google

Google paid $250,000 to the AI security startup XBOW for a full-chain exploit of Chrome. Four researchers built the chain in six days with OpenAI's GPT-5.6 Sol, and the compute cost about $40,000.

XBOW announced the award on October 13, 2026. The email from Google's Chrome Vulnerability Rewards Program (VRP) panel gives the reason as "Full chain exploit". XBOW says it is the first reward under Google's new 2026 rules. All three bugs in the chain are now fixed.

What happened

• The goal. At the start of 2026 XBOW set itself a challenge: a full-chain Chrome exploit by Black Hat in August.
• The first chain. When the team sent it to Google, Google said it already knew about one of the bugs.
• The rebuild. The team was already in Las Vegas for Black Hat and DEF CON. They built a new chain from Sunday, August 2, to Friday, August 7.
• The team. Four researchers (Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, Willem Pinckaers) plus GPT-5.6 Sol, which XBOW calls a "fifth colleague".
• The chain. Three bugs, built as three independent parts, each with a backup alternative.

The numbers

What XBOW says it means

XBOW builds an autonomous AI system that finds and exploits vulnerabilities. Its CEO, Oege de Moor, says the model behind this is "available to anyone".

The cost and time of finding serious vulnerabilities are falling fast, for attackers and defenders alike.

He adds that defenders keep one edge: "they can test their own code first."

Sources

• XBOW: XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days
• The Chrome VRP reward email shown above