Xbow engineer Brendan Dolan-Gavitt successfully discovered a full-chain vulnerability in the Google Chrome browser using OpenAI's gpt-5.6-sol model, winning Google's first-ever $250,000 bug bounty. During the six-day test, a human-AI collaborative model was used: human researchers selected targets, provided context, and determined code combinations, while the AI agent searched source code, tested hypotheses, and drafted the exploit code.
Xbow estimated the computational cost of this task at approximately $40,000 based on reconstructed Codex logs—a fraction of the prize money—and significantly less time and cost than the months of expert input required in traditional methods. The attack chain exploited three separate vulnerabilities, spanning two security boundaries, successfully transforming ordinary JavaScript in a tab into code that bypassed all sandbox restrictions and ran externally. Google subsequently reproduced the attack chain and confirmed all three vulnerabilities, and has since released patches.
