XBOW, a company that builds AI tools to hunt for security holes, says it built a working attack on Google's Chrome browser in six days with the help of AI agents, AI programs that can carry out tasks on their own. The attack chained three bugs the company found so that, XBOW says, simply visiting a web page could let an attacker run a program of their choosing on a Windows computer. XBOW published the details on Tuesday, Oct. 13, after the bugs were fixed, and says Google paid it a $250,000 reward, which it says was the first $250,000 reward for a full chain under rules Google introduced in April.
Chrome is built in layers. Each web page runs inside a walled-off space, called a sandbox, that is meant to keep it away from the rest of the computer. XBOW says an attacker who finds a single bug could take over a web page but go no further. A full chain strings together bugs that get past every layer, from an ordinary page to the machine itself. XBOW's chain used three bugs: one in the part of Chrome that runs website code, one in how it reads animated images, and one in its crash-reporting tool, which runs outside the sandbox. XBOW says it chose a full chain on Chrome as the hardest target it could think of, and it estimates the flaws put about a billion Chrome users at risk.
The AI was OpenAI's GPT-5.6 Sol, a model XBOW says it picked because anyone can use it, rather than a specialized security model. XBOW says the AI searched Chrome's code, tested ideas, built small demonstrations that each bug really worked and wrote early drafts of the attack, while XBOW's researchers chose where to look, checked the AI's work and decided which pieces to join. The computing for the six-day effort cost about $40,000, the company says. XBOW says Google already knew about one bug in its first chain, so a researcher and the agents built a new one between Aug. 2 and Aug. 7, drawing on that earlier work.
XBOW says that before today's AI models, a team of four would have needed six to nine months to build an attack like this, and its own first try took two months. Google's Chrome update notes credit an XBOW researcher, Brendan Dolan-Gavitt, with reporting two of the bugs, each rated high severity, and the U.S. government's public database of security flaws lists the crash-reporting flaw as letting an attacker who has already broken into a web page's walled-off space run code outside it on Windows.
The attack was not built by AI alone: XBOW says one human choice, building it in three swappable parts, was essential, and that its researchers' own skill and judgment mattered, so the same time and money would not let just anyone do it, though it says the bar is now much lower. The company, which is developing a product that tests software for security holes on its own, says it believes AI agents could find each of the three bugs without help within a year, something it has not shown. XBOW says asking whether to limit access to powerful AI models is the wrong question, since the one it used is already public. It is not known how many attackers can already move this fast.
Chrome installs updates on its own, but XBOW notes a fix takes effect only after the browser restarts, so it advises relaunching Chrome whenever the Update button appears.