XBOW uses OpenAI’s GPT-5.6 to exploit Chrome, earns $250,000 bounty

What happened

Autonomous offensive security company XBOW used OpenAI ’s GPT-5 (large language model by OpenAI).6 Sol model, working alongside human researchers, to find and exploit three previously unknown vulnerabilities in Google Chrome. That was the first full-chain bounty awarded in 2026, and only the second in the history of the program. OpenAI is an artificial intelligence company based in San Francisco.

AI-driven vulnerability discovery accelerates exploit (a piece of code that turns a flaw into a way in) timelines, challenging security protocols and potentially increasing attack risks. 13, 2026 A browser exploit chain that used to take elite researchers months just came together in six days.

The tab for the AI that helped build it came to around $40,000. Google paid out its maximum $250,000 bounty for the work.

Three bugs, one chain, six days The campaign ran from August 2 to August 7, 2026. XBOW made it public on October 13, 2026.

The team did the work during the Black Hat and DEF CON security conferences in Las Vegas. The chain stitched together three separate flaws. The first was a bug in the Maglev compiler inside V8, Chrome’s JavaScript (high-level programming language) engine.