The exploit was constructed using $40,000 of compute resources, a task that an intelligence agency veteran noted previously took 6 months. XBOW is now using the research to develop an autonomous product for testing servers, embedded devices, and desktop applications. Google and XBOW have urged users to update Chrome to mitigate the risk of attacks that can read emails and passwords without a user clicking a phishing link.
Tuesday, October 20, 2026
Story
XBOW Wins Google $250,000 Bounty for 6 Day AI Chrome Exploit
Cybersecurity7 days ago
A security firm combined three distinct software vulnerabilities into a single attack that can seize total control of a Windows computer via its web browser. The group, XBOW, used OpenAI's GPT-5.6 Sol as a teammate to develop the exploit in 6 days, earning a $250,000 bounty. This is the first full-chain reward awarded under Google's 2026 rules, the second in Chrome's history, and targets an estimated 1 billion users on Windows.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.