Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

What happened

Security researchers at XBOW combined three previously unknown vulnerabilities in Google Chrome to create a full-chain exploit that executes code on Windows machines just by visiting a crafted web page. They developed the complex attack in six days with the help of OpenAI’s publicly available GPT-5.6 Sol model, using AI agents to automate and accelerate the process. Google has confirmed and patched all three bugs and paid XBOW its top bug bounty for the exploit.

The risk

This exploit demonstrates how AI models can dramatically speed up the discovery and chaining of sophisticated exploits. A remote vulnerability that executes code without user interaction raises the stakes for defenders, as it reduces the time window for detection and patching. Attackers with similar AI tools could potentially replicate or improve such attacks, increasing the risk of widely impactful zero-click hacks that compromise systems silently.

Why it matters

Operators and defenders face pressure from AI-accelerated offensive capabilities that make vulnerability research and exploit development faster and more accessible. Chrome users must apply updates promptly since the exploit runs on a simple page load. Organizations relying on Chrome inside their infrastructure, such as managed Windows endpoints, need to treat browser security as a critical frontline defense. The payout signals that bug bounty programs must adapt to the rising complexity and speed of AI-aided threat research.

Who should pay attention

Security teams, browser developers, and endpoint operators should watch this case closely as it raises baseline risk assumptions. It shows attackers will more likely pair AI with traditional security weaknesses to craft seamless, high-impact exploits. Bug bounty managers and program designers should anticipate rising payouts for chained vulnerabilities supported by AI automation. Businesses deploying Chrome broadly need to prioritize patch management cycles and consider layered defenses to mitigate exploit risks.

What to watch next

Look for how other security researchers and threat groups adopt AI agents for exploit chaining and development. Monitor updates in bug bounty policies reflecting the increased value and speed of these AI-assisted findings. Expect Google and other browser vendors to accelerate security feature rollouts, sandbox enhancements, and telemetry improvements to detect exploit chains faster. Defensive AI tools may also evolve to counter AI-driven offensive research.

AI Quick Briefs Editorial Desk