XBOW researchers used AI agents to win a $250000 Chrome exploit bounty

$250,000 is the new going rate for finding a three-bug Chrome exploit chain. XBOW collected it during Black Hat and DEF CON week, in under a week.

During Black Hat and DEF CON week, XBOW's researchers spent six days chaining together three separate flaws in Chrome. The Seattle-based autonomous security startup said Google paid $250,000 for the full-chain exploit, the first award of its kind under the Chrome Vulnerability Reward Program's rules that took effect this year. The team built the exploit between August 2 and August 7, working alongside AI agents running OpenAI's GPT-5.6 Sol model, according to a blog post XBOW published October 13. Google has since reproduced the bugs, confirmed them, and shipped fixes. None of the three flaws were ever exploited against real Chrome users.

Here's the part worth sitting with: this wasn't a model working alone. XBOW's own account, laid out in a companion technical post, describes researchers choosing targets, supplying context, challenging the agents' results, and deciding which pieces of the exploit to stitch together. The AI searched Chrome's source code, tested ideas, built proofs of concept, and wrote early drafts of the exploit code. The humans set the strategy and kept checking the work. That's a different story than "a chatbot found a Chrome zero-day by itself." It's a more useful one, too: it shows where AI actually earns its keep in offensive security right now. Speed and breadth, not independent judgment.

The chain itself is a tidy piece of engineering. The first stage exploited a bug in Chrome's Maglev compiler, where a mutable boxed number got reused during deoptimization, giving the exploit read and write access across V8's pointer-compression cage. The second stage escaped that sandbox through a flaw in the animated WebP decoder, where cached geometry data didn't match changed image bytes, producing one precisely targeted write outside the cage. The third and final stage abused a bug in Crashpad, Chrome's crash-reporting component, which treated a failed read from a supposedly frozen renderer process as if it were a stable, trustworthy observation. Chain all three together and you get unsandboxed code execution on a Windows machine running Chrome.

XBOW says the compute for the entire campaign cost $40,000 in API charges, a fraction of the $250,000 payout. The company also says pre-LLM Chrome full-chain work could take a team of four roughly six to nine months. Compressing that timeline from six months to six days is the actual headline here, not the bounty check. Bug bounty economics were built around the assumption that finding a Chrome full-chain is rare and slow.

That's the assumption XBOW's post quietly demolishes. It makes the case that rare and slow is becoming neither, at least for a team willing to pair strategy with agents that can read millions of lines of V8 source code overnight.

That compression has a flip side, and XBOW doesn't pretend otherwise. The same acceleration that let a defensive team find three bugs in a week could just as easily help an attacker who has no intention of filing a disclosure. The company frames its own work as responsible, and Google's confirmation that the flaws were patched before anyone abused them backs that framing up. But the tooling that found them doesn't come with a conscience built in. Whoever runs GPT-5.6 Sol against Chrome's source tree gets to decide what happens to the result.

This award didn't happen in isolation. According to XBOW, the company has submitted more than 1,060 vulnerabilities across real-world production targets. XBOW says that showing helped it become the first autonomous system to reach No. 1 on HackerOne's U.S. leaderboard, a milestone CSOonline covered last year. XBOW was founded in 2024 by Oege de Moor, who previously created GitHub Copilot. The company has raised more than $270 million; its Series C financing valued it above $1 billion, and a later strategic extension drew participation from Nvidia's venture arm, Samsung, and SentinelOne, among others.

Frankly, the Chrome bounty is the clearest proof yet that the investors chasing this category aren't betting on a demo. A quarter-million-dollar check from Google, for bugs Google's own engineers hadn't caught, is as hard a receipt as offensive AI security gets. Whether that receipt reads as reassuring or alarming probably depends on which side of the exploit chain you expect to be standing on time.

Also read: Liquid AI's LFM2.5-24B-A2B Runs Agent Tasks Locally on a Laptop • Figure AI's former safety engineer says its robot can fracture a skull • A new paper says OpenAI's Navier-Stokes proof and its Lean code don't match

This article is posted in AI News , check it out for more related stories.

Almost there. Sign in and your posts straight away.