XBOW builds a Chrome vulnerability chain in six days with SI agents; Google confirms it and pays $250,000
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
Finding serious vulnerabilities with SI agents now takes days and tens of thousands of dollars instead of months, and the vendor managed to fix the bugs found.
Researchers at XBOW chained three previously unknown Chrome bugs into a single attack that executes code on a Windows computer outside the browser's sandbox when a malicious page is opened. According to XBOW and The Next Web, the work ran August 2–7 with SI agents on OpenAI's publicly available GPT-5.6 Sol model, and compute costs came to about $40,000. The agents searched Chrome's source code, tested ideas and wrote first drafts of the exploit; XBOW describes the humans as directing the process: they chose targets, supplied context, checked results and decided which parts to combine. Google confirmed all three bugs, fixed them (patches of August 25 and September 3), according to The Next Web found no signs of exploitation, and paid the top reward of $250,000. XBOW estimates that the vulnerable Chrome reaches about a billion users.
Sources 2