XBOW Uses GPT-5.6 Sol to Breach Chrome Sandbox, Winning $250k Bounty

Security research team XBOW leveraged OpenAI's GPT-5.6 Sol model and four researchers to successfully exploit the Chrome browser sandbox in just 6 days, earning a $250,000 bug bounty from Google. The discovered vulnerabilities have already been patched by Google. This achievement represents a major milestone in AI and cybersecurity, demonstrating how advanced AI agents can drastically accelerate the discovery of complex software vulnerabilities from months down to days. It highlights the shifting paradigm of security research where human-in-the-loop AI systems become primary drivers for penetration testing. The project involved an AI compute cost of approximately $40,000, with the AI handling source code searching, testing ideas, and building initial proof-of-concept exploit versions. The human researchers directed the overall strategy, evaluated agent results, and guided the actions based on intermediate outcomes.