XBOW used GPT-5.6 Sol to build a $250,000 Chrome exploit in six days

A full chain in six days

Security firm XBOW has won $250,000 from Google's Chrome bug bounty programme, the company announced on 13 October. The winning work was a "full chain" exploit that combines multiple flaws in the browser.

According to a technical write-up by XBOW researcher Brendan Dolan-Gavitt, the chain was produced with the GPT-5.6 Sol model in six days. He notes that before LLMs, the same job took a team of four roughly 6-9 months.

What the numbers show

Dolan-Gavitt says the company's first submission took two months, while the awarded one took six days. It is a concrete example of how fast AI-assisted security research can move.

A full-chain exploit links separate weaknesses together; such bugs are considered far more valuable than a single flaw.

Why it matters

AI models are no longer just writing code; they are also being used to find vulnerabilities and develop exploits. The case shows that attack capacity is rising alongside defensive speed.