AI Security Firm XBOW Uses GPT-5.6 to Build Full-Chain Chrome Zero-Day Exploit

Automated fuzzing tools have spent the last decade throwing random data at web browsers to uncover isolated memory crashes, but they have always required human engineers to turn those crashes into working exploits. The difference this week is that an autonomous agent did the engineering itself.

Security startup XBOW announced on Tuesday that it used a modified version of OpenAI’s GPT-5.6 Sol model to build a full-chain zero-day exploit against Google Chrome. The exploit successfully bypassed the browser's sandbox protections to execute arbitrary code.[5]

The achievement earned the research team a $250,000 bug bounty from Google, confirming the vulnerabilities were genuine and previously unknown. The entire process, from initial discovery to a working proof of concept, took the AI system just six days.[3][4][5]

While marketing materials often describe AI hackers as omnipotent digital ghosts, the reality of XBOW’s system is far more mechanical. The firm did not unleash a sentient virus, but rather built a structured environment where the language model could iteratively test code.

"The model isn't magically guessing the right memory offsets on the first try," XBOW researchers noted in their technical write-up. "It is writing a script, watching it fail, reading the crash dump, and rewriting the script until it works."[6]

The Mechanics of a Full Chain

To compromise a modern browser like Chrome, an attacker cannot rely on a single flaw. They must string together a full chain of vulnerabilities that sequentially defeat multiple layers of security architecture.

According to Forbes, the XBOW agent first discovered a memory corruption bug in Chrome's V8 JavaScript engine. It then identified a second vulnerability in the browser's sandbox, allowing the initial execution to escape its isolated environment and reach the underlying operating system.[1]

A third flaw was utilized to bypass operating system mitigations, ultimately allowing the agent to launch the calculator application—the universal cybersecurity proof that a system has been fully compromised. The Register reported that this specific chain affected a codebase used by over a billion users.[1][2]

"Security researchers spent six days doing their Chromework," The Register noted. The publication highlighted that the AI agent operated continuously, compiling and testing thousands of variations without requiring sleep or context-switching.[2]

The underlying engine driving this automation is GPT-5.6 Sol, an off-the-shelf model from OpenAI that features extended context windows and improved reasoning capabilities. XBOW wrapped this model in a proprietary framework that provided it with debugging tools and a live Chrome environment.[1][5]

This setup is crucial for understanding the capability. The AI did not find the exploit by simply reading Chrome's source code in a vacuum; it required a highly specialized scaffolding built by human security experts to guide its attention and validate its attempts.[6]

Shifting the Economics of Exploitation

The successful automated chain represents a fundamental shift in the economics of vulnerability research. Historically, developing a reliable Chrome sandbox escape required months of dedicated effort from top-tier security engineers.

A working zero-day exploit for a major browser can sell for millions of dollars on the gray market because of the immense human labor involved. By compressing that labor into six days of compute time, XBOW has demonstrated that the barrier to entry is collapsing.[5]

Google’s decision to award the $250,000 bounty validates the threat model. The tech giant has increasingly relied on its own automated systems, including the OSS-Fuzz project, to find bugs before release, but defensive automation must now race against offensive AI.[3]

"Google awarded a $250,000 bounty for a full-chain Chrome exploit found using GPT-5.6," Cyber Security News reported. The rapid payout reflects the industry's urgency to patch machine-generated vulnerabilities before they can be weaponized.[3]

Despite the alarming premise of an AI building cyberweapons, the cybersecurity community largely views this development as a net positive. When white-hat researchers use these tools to find and report flaws, the resulting patches make the software more resilient against human adversaries.[4]

What Happens Next

The immediate consequence of XBOW’s demonstration is that software vendors can no longer rely on the sheer complexity of their codebases as a deterrent. If an AI can navigate the V8 engine's memory management, obscurity offers no protection.

The longer-term concern is proliferation. While XBOW responsibly disclosed its findings to Google, the underlying GPT-5.6 Sol model is commercially available, meaning state-sponsored actors and well-funded criminal syndicates can build similar automated exploitation frameworks.[1]

Startup Fortune highlighted that XBOW researchers used these AI agents specifically to prove that defensive postures must evolve. The firm argues that the only way to secure future infrastructure is to deploy defensive AI agents that patch vulnerabilities faster than offensive agents can find them.[4]

The V8 JavaScript engine, which powers both Chrome and Node.js, is notoriously complex. It uses just-in-time compilation to optimize code on the fly, creating transient memory states that are incredibly difficult for human researchers to track and manipulate reliably.[6]

An autonomous agent excels in this environment because it can perfectly track thousands of memory addresses across hundreds of execution threads. It does not lose its train of thought when a compilation pipeline shifts, allowing it to spot race conditions that humans routinely miss.[6]

This capability extends far beyond web browsers. Operating systems, hypervisors, and enterprise networking equipment all rely on similar memory management techniques, making them equally susceptible to automated vulnerability discovery by sufficiently advanced language models.

Ultimately, the six-day timeline achieved by XBOW is just a benchmark. As models improve and agentic frameworks become more sophisticated, the window between a software release and its first automated compromise will only continue to shrink.