Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
Summary
Researchers at XBOW developed a full-chain Chrome exploit capable of executing code on a Windows machine by simply loading a webpage. They achieved this feat in six days by utilizing AI agents powered by OpenAI's GPT-5.6 Sol model. Google has since confirmed and patched the vulnerabilities, rewarding XBOW for their discovery.
IFF Assessment
This article reports on the creation of a sophisticated exploit, which is a negative development for defenders.
Severity
The exploit allows for remote code execution on a Windows system via a web page load, indicating a high impact and attack vector. Given it chained three unknown bugs, the exploitability is likely high.
Defender Context
This incident highlights the potential for AI to accelerate exploit development, enabling attackers to chain vulnerabilities much faster than before. Defenders should be aware of the increasing sophistication and speed of exploit creation, and prioritize patching known vulnerabilities and enhancing detection capabilities for novel attack vectors.