Security firm XBow won Google's $250,000 full-chain Chrome bug bounty after building an exploit in six days using OpenAI's GPT-5.6 Sol at a compute cost of $40,000, with engineer Brendan Dolan-Gavitt running the model against Chrome's source code while human engineers guided targeting.
The finished chain crossed two protective boundaries through three flaws, turning ordinary JavaScript into code running outside every sandbox, and affects over a billion Chrome users on Windows with no user action required beyond visiting a malicious site. Google confirmed all three bugs and shipped fixes; item 12284 notes GPT-5.6 Sol is already two generations behind current models such as GPT-6.1 Sol and Opus 5.5.