An AI just did in six days what used to take elite hackers half a year — and got paid a quarter of a million dollars for it. Security startup XBOW announced it earned Google’s $250,000 top reward for a full Chrome exploit chain built with help from OpenAI’s GPT-5.6 Sol. It’s the first full-chain payout under Google’s 2026 bounty rules, and it may be the clearest proof yet that the AI bug bounty era has arrived.
What happened: the $250,000 find
On October 9, XBOW announced through an official press release that Google’s Chrome Vulnerability Reward Program had paid it $250,000. The company disclosed the full technical details on October 13.
One security researcher, working with AI agents over six days, chained three previously unknown Chrome bugs into a single attack. The exploit ran code outside Chrome’s sandbox on Windows — triggered by loading a web page. No clicks, no downloads.
XBOW estimates the flaws sat in the path of roughly one billion Chrome-on-Windows users. Google reproduced the exploit, shipped fixes, and paid out. None of the bugs was ever used against real users.
The exploit chain, stage by stage
| Stage | Component | What the bug did |
|---|---|---|
| 1 | V8 JavaScript engine (Maglev compiler) | Gave the attacker control of memory inside the engine’s sandbox |
| 2 | Animated-WebP image decoder (CVE-2026-85045) | Broke out of the sandbox with a single precise write to native memory |
| 3 | Crashpad crash handler (CVE-2026-78952) | Turned that foothold into full code execution outside the sandbox |
Each stage crossed a security boundary — Chrome traps web-page code inside two nested sandboxes, and the chain walked through both. The demo ended with Windows Calculator launching from a web page: proof an attacker could have run anything.
How the 3-stage chain crossed Chrome’s defenses
The model behind it: GPT-5.6 Sol
The AI wasn’t a secret lab prototype. It was GPT-5.6 Sol, a public OpenAI model that XBOW’s agents used to search Chrome’s source code and draft exploit stages.
The humans stayed in charge. XBOW’s researchers chose targets, supplied context, challenged the agents’ results, and decided which pieces to chain together. As researcher Brendan Dolan-Gavitt wrote in the technical write-up, the team applied “a fair bit of our own human expertise and judgment.”
OpenAI endorsed the outcome. Clint Gibler, OpenAI’s Head of Cyber Research, said the company is working “to put these capabilities in more defenders’ hands,” and co-founder Greg Brockman highlighted the result publicly.
The money math: 6.25x in six days
XBOW reports the six-day sprint cost about $40,000 in API compute. The payout: $250,000. That’s a 6.25x gross return on compute — before counting the researchers’ time.
| Metric | Figure | Source |
|---|---|---|
| Bounty paid | $250,000 | XBOW / Google Chrome VRP |
| AI compute cost | ~$40,000 | XBOW technical write-up |
| Time to full chain | 6 days (Aug 2–7) | XBOW disclosure |
| Pre-AI equivalent | 6–9 months (team of four) | XBOW researcher write-up |
| Users in scope | ~1 billion (Chrome on Windows) | XBOW announcement |
| Gross return on compute | 6.25x | Calculated from official figures |
XBOW’s CEO Oege de Moor put it bluntly: it took “an estimated $40,000 of compute and six days for a single researcher to produce a chain that previously would have taken months.”
How to profit from the AI bug bounty boom
Bug bounties were already a real income stream for independent security researchers. AI just collapsed the cost of entry. Here’s a concrete playbook:
- Start with a public program. Google’s Chrome VRP, Mozilla’s bounty, HackerOne, and Bugcrowd publish rules and payout tables. Read them first — scope violations get you banned, not paid.
- Learn the AI-assisted workflow. XBOW’s recipe is public: humans pick targets and verify; agents read source at machine speed and draft proofs of concept. Practice on open-source code first — Chromium’s source is public.
- Budget for compute, not salaries. XBOW spent ~$40K in API calls for a top-tier result. Hunting smaller bounties ($500–$10,000 on HackerOne) can start with a few hundred dollars of API credits.
- Specialize in chains, not single bugs. XBOW’s CEO noted that “separate, perhaps even low-severity, vulnerabilities can now be chained together into a high-severity exploit path.” AI is best at exactly this: holding dozens of candidate bugs in memory and testing combinations a human would never try.
- Sell the skill, not just the bugs. Companies are hiring AI red-teamers faster than they can find them. A public track record of paid disclosures is the strongest résumé in this market.
One caution: the same acceleration helps attackers. XBOW disclosed responsibly and Google patched before anyone was harmed. Work inside program rules, or the legal exposure will dwarf any payout.
Why this changes bug bounty economics
Bounty programs were priced on the assumption that a Chrome full chain is rare and slow. Google’s $250,000 top reward exists because almost nobody can earn it. XBOW just showed one researcher with AI agents can do it in a week.
If “rare and slow” becomes “repeatable and fast,” defenders get dramatically more coverage — and the economics of attack collapse too. The payout tables are public, the tooling is public, and the skill gap is wide open.
Frequently asked questions
What is an AI bug bounty?
A cash reward paid for finding security vulnerabilities with AI assistance. Programs like Google’s Chrome VRP pay researchers — increasingly AI-assisted teams — for responsibly disclosed bugs.
How much did Google pay XBOW for the Chrome exploit?
$250,000 — Google’s top full-chain reward, and the first under the program’s 2026 rules. The exploit chained three unknown bugs affecting an estimated one billion Chrome-on-Windows users.
Which AI model found the Chrome vulnerabilities?
OpenAI’s GPT-5.6 Sol — a publicly available model. XBOW’s agents used it to search Chrome’s source code and draft exploit stages while humans directed strategy.
How long did the AI-assisted hack take?
Six days (August 2–7, 2026), at roughly $40,000 in API charges. Pre-AI, a Chrome full chain typically took a team of four six to nine months.
Were Chrome users at risk?
No. XBOW reported all three bugs through Google’s program, Google patched them in Chrome 152 updates (late August/early September 2026), and XBOW states they were never used against real users.
Can I hunt bug bounties with AI as a side hustle?
Yes. Start with public programs (Google VRP, HackerOne, Bugcrowd), learn XBOW’s human-directed AI workflow, budget a few hundred dollars in API credits, and always stay inside each program’s scope.
What are CVE-2026-85045 and CVE-2026-78952?
The two publicly tracked bugs in XBOW’s chain: CVE-2026-85045 is the animated-WebP decoder flaw used to escape the V8 sandbox, and CVE-2026-78952 is the Crashpad crash-handler flaw used to gain code execution outside the sandbox. Both are patched.
Sources
- XBOW’s official announcement: $250,000 Chrome full-chain reward (Business Wire)
- The Register: six-day AI-assisted Chrome exploit, $250K bounty
- Startup Fortune: XBOW researchers used AI agents to win the $250,000 bounty