AI-powered attack chain exploiting Chrome earns $250,000 Google bounty

In one of the most significant cybersecurity developments of the past 24 hours, an AI-powered Chrome exploit chain assembled by automated agents has been officially disclosed and verified by multiple independent sources. Security firm XBOW has confirmed it used connected AI agents, running OpenAI’s publicly available GPT-5.6 Sol model, to autonomously design and execute a complete Chrome vulnerability chain. This innovative attack bypassed key browser sandboxes to achieve code execution on Windows systems, prompting Google to award its largest Chrome bug bounty to date: $250,000. The emergence of an AI-powered Chrome exploit demonstrates a fundamental shift in both attack methodology and defensive priorities across the cybersecurity industry.

The AI breakthrough at the heart of the exploit

The disclosed operation, conducted by XBOW, took place between August 2 and August 7, 2026. Using OpenAI’s GPT-5.6 Sol (available to the public), the security team guided clusters of AI agents to find, develop, and chain together three separate vulnerabilities. These included:

A flaw in Chrome’s Maglev V8 compiler
An animated WebP image-decoder bug (CVE-2026-85045)
A Chrome Crashpad memory-handling issue

By automating discovery and chaining, the AI agents escaped the Chrome renderer sandbox and V8 engine sandbox, culminating in remote code execution entirely from visiting a single malicious webpage.

Why the AI-powered Chrome exploit matters for cybersecurity

This exploit marks the first time publicly accessible AI agents have been documented to fully automate both the analysis and construction of a viable, end-to-end software attack chain. This development validates predictions that large language models (LLMs) and autonomous agents will rapidly increase threat sophistication and scale, especially when guided or fine-tuned for security research.

Google’s award of $250,000, its largest Chrome bounty, signals the magnitude of this shift. As of October 15, 2026, both Google and third-party researchers have independently confirmed the capabilities demonstrated in the exploit.

Technical details and responsible disclosure

XBOW’s methodology exemplifies responsible vulnerability disclosure. The AI agents were initially steered toward the Chrome attack surface using public documentation, source code, and previously reported issues. Over a $40,000 compute budget and six days, the agents:

Identified the Maglev JIT compiler vulnerability in V8
Mapped the attack prerequisites and wrote the proof-of-concept exploit
Chained the animated WebP image bug (CVE-2026-85045) for remote payload injection
Combined this with a memory issue in Crashpad to break out of the V8 and Chrome sandboxes

All results and proof-of-concept code were rapidly reported to Google’s Chrome security team under a coordinated disclosure model.

The industry impact: what comes next?

This milestone arrives amid a surge of AI integration in both security research and exploit development. It demonstrates that LLM-powered agents can traverse complex software targets, synthesize exploit chains, and even bypass industry-standard isolation mechanisms. This is no longer theoretical; practitioners, incident responders, and software vendors must now add autonomous AI exploitation to their threat models.

The industry is already seeing responses. Google, Microsoft, and other browser vendors are stepping up their AI-powered code analysis and fuzzing operations. Meanwhile, security professionals are reevaluating authorization boundaries, patch pipelines, and the design of bug bounty programs to account for the speed and tactics of AI-assisted discovery. More practical advice and context can be found in CyberProfi’s cybersecurity and artificial intelligence explainer sections.

Practical guidance for security teams and developers

Apply all recent Chrome security patches immediately to mitigate known vulnerabilities exploited by this chain.
Invest in AI-augmented vulnerability discovery tools for internal security testing.
Monitor bug bounty and threat intelligence feeds for evidence of automated attack chains and associated proofs of concept.
Redesign sandbox architectures for defense-in-depth, assuming attackers can automate chaining across process and privilege boundaries.
Foster collaboration with trusted AI researchers and responsible disclosure programs.

Frequently Asked Questions

What made this AI-powered Chrome exploit unique?: It was the first case where AI agents running a large language model autonomously chained and weaponized multiple real-world Chrome vulnerabilities, bypassing both renderer and JavaScript engine sandboxes without direct human input on the exploit logic.
How did Google respond to the disclosure?: Google verified the exploit, issued urgent patches, and paid a $250,000 bounty—its largest ever for Chrome. The company has since expanded its investments in AI-driven code review and browser defense automation.
Should average Chrome users be worried?: Users should always keep Chrome updated to the latest version, as security fixes are continually issued. The disclosed vulnerabilities have been patched. However, the method signals a trend toward more rapid, AI-driven exploit development in the wild.
How common is AI-led exploit development today?: This event sets a new precedent. While researcher teams have piloted smaller efforts, this is the first high-profile demonstration on a mainstream browser validated by both bounty programs and the broader security community.
Where can professionals learn more about AI-augmented security testing?: For in-depth guides, visit CyberProfi’s cybersecurity section or the AI resources for research, trends, and practical tutorials.