The proof of concept is almost anticlimactic. A page loads in a signed build of Chrome Beta, and the calculator application appears on the desktop. Nothing is downloaded, nothing is clicked, and the browser reports no error.
That screenshot sits in a technical writeup published by XBOW this month, and it is the visible end of a chain the security company says it built in six days with the help of AI agents, using three vulnerabilities that Google had never seen.
On Oct 13, XBOW announced that the chain had earned a $250,000 award from Google’s Chrome Vulnerability Rewards Program, describing it as the first full-chain payment under rules the search company introduced in April 2026 and the first won by an autonomous system, the company said in a statement. Google confirmed the exploit worked and shipped a fix, tracked publicly as Chromium issue 545820931.
The chain moved through three stages. It began with a bug in the V8 JavaScript engine that gave the exploit control of memory inside the browser’s own cage. It continued through a flaw in Chrome’s animated WebP image decoder, CVE-2026-85045, which XBOW used to escape the V8 sandbox by exploiting a property that sandbox deliberately does not police and that the Blink rendering code assumed it could trust. It finished with a memory-safety flaw in Crashpad, CVE-2026-78952, a crash reporter running outside the sandbox, which turned renderer control into code execution on the host machine.
The work was spread across parallel campaigns rather than handed to one agent end to end: a broad search for candidate flaws, memory corruption inside V8, an escape from the V8 sandbox, an escape from the renderer sandbox, and integration. Agents running OpenAI’s gpt-5.6-sol model read source code, tested hypotheses and built proofs of concept, while XBOW’s researchers chose targets, supplied context, challenged results and decided which pieces to join.
The clock ran from Sunday, Aug. 2, to Friday, Aug. 7. The company reconstructed the cost from archived logs of the agents’ sessions and put it at roughly $40,000 in model charges. Partway through, the original V8 escape stopped cooperating, and researchers replaced it with the WebP stage rather than rebuilding the chain — a modularity the team had designed in advance, with each stage given a clean interface so it could be swapped out.
For scale, XBOW said a full Chrome chain before large language models took a team of four people six to nine months. Its own first submission took two months. This one took six days. The company also published the limits of that comparison: human judgment still steered the work, and reproducing the result does not follow automatically from the budget. But the cost of trying has fallen enough that the number of people who can plausibly attempt it is no longer small.
One stage shows how the seam between components decides these outcomes. To keep the final step reliable, the exploit created a renderer thread with a Windows flag that exempts it from process suspension, so the thread kept running while the crash reporter took the snapshot it uses to capture a failure. That turned a safety mechanism into a delivery channel. Each provider’s code was defensible on its own; the opening existed where two of them met.
The detail in the writeup that best explains the outcome is not the model. The agents drew on techniques previously developed by XBOW’s own researchers, among them a loader the team calls island hopping, which stitches control flow across a sequence of small code fragments until the pieces assemble into a working payload. Models perform best when they have high-quality examples to imitate, and that inheritance is the part of the process a competitor cannot download.
XBOW is not a research hobby. The Seattle company was founded in January 2024 by Oege de Moor, who previously worked on GitHub’s Copilot and CodeQL tools, and it sells autonomous penetration testing to enterprises. In June 2025 it became the first autonomous system to reach the top of HackerOne’s United States leaderboard, ahead of every human participant. In March, it raised $120 million in a Series C round led by DFJ Growth and Northzone, valuing it at more than $1 billion.
The vulnerabilities described in the writeup theoretically affected about a billion people using Chrome on Windows before the fix, XBOW said, and the company said it has no evidence they were used in real attacks.
Google’s response came the following day, when it updated the Chrome program’s rules: the base award for a memory-corruption vulnerability rises fourfold to $2,000, with other categories expanded as well. The company has been paying more for the same class of work at the moment the work is getting faster and cheaper to produce.
That arithmetic is the uncomfortable part. A $250,000 payout against $40,000 of compute is a healthy margin for a company that sells security testing, and a signal to everyone else that full-chain exploits are becoming a service rather than a rare skill. The bottleneck moves from finding the bugs to patching them, and from patching them to the length of time a browser ships a flaw that a machine can find and other machines can weaponize.
XBOW’s researchers closed their writeup with a warning rather than a boast: the bar is significantly lower, and defenders should plan accordingly. The next chain will not announce itself in a blog post. It will look like a page someone loaded, and a program that opened that nobody asked for.
