Physix FrontierPhysix Frontier · News Briefing Card (IT Home · Oct 14, 2026)
XBOW Breaks Chrome Sandbox in 6 Days with GPT-5.6 Sol, Wins $250K
KEY FACTS
- Security team XBOW discovered and built a full-chain exploit for the Chrome browser.
- The vulnerability was expected to affect about 1 billion users worldwide, and Google has patched it.
- Google paid XBOW a $250,000 bug bounty.
- Using models including GPT-5.6 Sol and four researchers, XBOW broke into Chrome and gained full system access in just 6 days.
- The team spent about $40,000 on compute, with AI handling source code search and writing the first version of the exploit.
KEY DATA
$250,000Bug bounty
about 1 billionAffected users
6 daysTime to break in
about $40,000Compute cost
PHYSIX OBSERVATION
AI compresses vulnerability discovery from months to days at a cost of only $40,000, and that changes the economics of attack and defense. Attackers use large models to search code at scale; if defenders still rely on manual auditing, they will be increasingly passive. Google paying a bounty and patching is a good thing, but what deserves more attention is this: AI-assisted attacks are moving from concept to reproducible engineering, and browser vendors' security investment must be upgraded in step.
Source: IT Home report