--- title: $40,000 of GPT-5.6 compute just bought a $250K Chrome bounty description: An AI agent built on OpenAI's gpt-5.6-sol model, run by Xbow engineer Brendan Dolan-Gavitt against Chrome's source code, found a full-chain exploit crossing... canonical: https://daily.dev/posts/40-000-of-gpt-5-6-compute-just-bought-a-250k-chrome-bounty-bvfge3w7i twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: $40,000 of GPT-5.6 compute just bought a $250K Chrome bounty | daily.dev og:description: An AI agent built on OpenAI's gpt-5.6-sol model, run by Xbow engineer Brendan Dolan-Gavitt against Chrome's source code, found a full-chain exploit crossing... og:url: https://daily.dev/posts/40-000-of-gpt-5-6-compute-just-bought-a-250k-chrome-bounty-bvfge3w7i og:image: https://api.daily.dev/og/posts/bVFGE3w7i.png og:image:alt: $40,000 of GPT-5.6 compute just bought a $250K Chrome bounty og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # $40,000 of GPT-5.6 compute just bought a $250K Chrome bounty **[Trends](https://daily.dev/sources/trends)** · 3 min read · 0 upvotes · 0 comments ## Summary An AI agent built on OpenAI's gpt-5.6-sol model, run by Xbow engineer Brendan Dolan-Gavitt against Chrome's source code, found a full-chain exploit crossing two sandbox boundaries via three flaws, costing roughly $40,000 in compute and earning a $250,000 Google bounty — only the second such payout in Chrome's history, and both times awarded to Xbow. Humans picked targets and stitched together pieces while the agent searched code and drafted exploit stages. At the budget end, a KeyGraph agent called Shannon found and proved eight real vulnerabilities in a personal Kubernetes app in about three hours for roughly $2, including a stored XSS chain exposing cluster secrets. The framing from both camps is that AI-assisted security testing could let defenders match attacker economics, turning pentesting into a continuous process rather than an annual event, while still leaving judgment calls to humans. ## Content The number everyone keeps repeating: six days, about $40,000 in compute, one full-chain Chrome exploit. Google paid XBOW $250,000 for it, the top Chrome payout and the first full-chain reward under its 2026 rules. The model wasn't a secret lab build. It was OpenAI's publicly available GPT-5.6 Sol. ## The argument that matters XBOW's CEO says the takeaway is that restricting access to powerful models is the wrong defense strategy, since the thing that did this is already public. @gdb ran with the same framing, calling it an opportunity for defenders "to secure their software to unprecedented levels." That's the optimistic read: the same economics that let a startup do this let a vendor find the bugs first. The less comfortable read sits right next to it. XBOW's own estimate is that a comparable chain used to take a team of four researchers six to nine months. Now it's a week and a cloud bill. Whoever can afford $40K can play, and not everyone who can afford it files a bounty report. ## What actually broke Three previously unknown bugs, chained: a flaw in V8's Maglev compiler, an animated-WebP sandbox escape, and a memory-safety overflow in the Crashpad crash handler. Load a web page, no clicks, and code runs outside Chrome's sandbox on Windows. Google puts the exposure at roughly a billion Windows users, says none of it was exploited in the wild, and has patched everything. Update to Chrome 152.0.7977.82 or later and relaunch. ## The humans haven't left @rohanpaul_ai's recap stresses that this wasn't push-button. Engineer Brendan Dolan-Gavitt and colleagues picked targets, supplied context, and decided which pieces to join, while the agents searched code, tested hypotheses and drafted exploit stages. The six days also followed months of earlier preparation, which the $40K headline glosses over. XBOW published full technical details in a blog post. ## Same story, smaller scale The cheap-offense theme showed up elsewhere too. KeyGraph's open-source agent Shannon was pointed at a Kubernetes-backed app and found and exploited eight real vulnerabilities in about three hours for roughly $2. It only reports what it proved, including an XSS chain that stole a session token and read cluster secrets. The author argues pentesting shifts from an annual event to something you run every release, and says it frees human testers for harder judgment calls rather than replacing them. A $250K bounty and a $2 pentest are the same bet: the bottleneck moved from finding bugs to fixing them. ## Questions this post answers ### how much did it cost to find the Chrome exploit that earned a $250,000 Google bug bounty Roughly $40,000 in compute, using OpenAI's gpt-5.6-sol model run by Xbow engineer Brendan Dolan-Gavitt over about six days against Chrome's source code. The resulting exploit chain crossed two sandbox boundaries through three separate flaws, starting from ordinary JavaScript in a browser tab and ending with code execution outside the sandbox. Google reproduced the chain, confirmed all three bugs, and shipped fixes. _Security teams weighing AI-assisted exploit hunting against traditional pentesting costs can track these economics on daily.dev._ ### has Google ever paid a $250,000 full-chain Chrome bug bounty before Yes, only once before, making this the second time in Chrome's history Google has paid a $250,000 full-chain bounty, and both times it went to Xbow. This particular payout was also Google's first full-chain Chrome bounty of 2026, for a bug class estimated to affect around 1 billion users. _Anyone tracking browser security bounty trends can follow updates like this on daily.dev._ ### what did the Shannon AI agent from KeyGraph find in a Kubernetes app Shannon exploited eight real vulnerabilities in a personal Kubernetes-backed app in about three hours for roughly $2 in compute, including a stored XSS chain that stole a session token and read cluster secrets. It only reports bugs it has proven by actually exploiting them, avoiding the noise of speculative scanner findings. The tool is open source, while KeyGraph sells a hosted layer with dashboards and compliance features. _Developers evaluating low-cost continuous AI pentesting tools can keep up with projects like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 4 discussions and 182 comments across x (as of 2026-10-17). **TL;DR:** Reaction is mostly impressed by the cost/reward ratio of using an AI agent to find a full-chain Chrome exploit, with many framing it as proof defenders can now afford to run attacker-grade adversarial testing on their own code; a smaller but vocal group questions the ROI logic, the human stitching involved, and whether attackers benefit from the same cheap economics. **Sentiment:** 45% positive · 40% mixed · 15% skeptical **The case for** - Many see the $40k-for-$250k ratio as a clear demonstration that AI-assisted vulnerability hunting now has working unit economics. - Several argue this gives defenders a realistic shot at running attacker-level adversarial sweeps on their own code before release. - Some note the significance of using a publicly available model (not a restricted security-specific one) to achieve the result. **The pushback** - Some point out that if the $40k figure excludes failed attempts elsewhere, the true success rate and ROI could be far worse than advertised. - Multiple commenters note attackers have access to the same cheap compute, so the cost asymmetry may not actually favor defenders. - Others question how much of the work was autonomous versus human steering/stitching, implying the achievement is overstated. - A few argue the bounty is too small relative to the scale of exposure (over a billion Chrome users). **By community** - x (mixed): Reactions range from excitement about the cost/reward ratio and defender-economics framing to skepticism about true ROI, human involvement, and whether attackers benefit equally from the same cheap compute. **Hottest debate:** Whether cheap AI-driven exploit discovery actually favors defenders, or whether it hands attackers the same price advantage, offsetting any defensive edge. **Open questions** - How much of the exploit chain was found autonomously by the agent versus assembled through human steering? - Does the $40,000 figure include unsuccessful attempts on other targets, and what is the true hit rate for this kind of agent run? - Can defenders realistically run this kind of continuous adversarial testing at the same pace and cost as attackers? - How will disclosure and patching pipelines keep up if bug discovery keeps getting cheaper and faster? **Highlights** > @nariman_orujov @gdb As long as they didn’t also spend $40k trying and failing to find a vulnerability in a bunch of other products. If $40k finds one most of the time it’s good ROI. If it’s only 10% successful, that’s not good. > — [The\_Sublimatory on x](https://x.com/The_Sublimatory/status/2110363360499843186) > @gdb spending $40K to get $250K. nice roi > — [nariman\_orujov on x · 67 points, 2 comments](https://x.com/nariman_orujov/status/2110078646014935372) > @shrsv23 @gdb Full-chain Chrome RCE (Windows): V8 Maglev compiler bug (mutable HeapNumber for in-sandbox R/W), animated-WebP decoder TOCTOU (native write escape), Crashpad ReadUpTo overflow (unsandboxed code exec). Webpage visit triggers arbitrary code outside sandbox. Found in 6 days (Aug > — [grok on x · 2 points](https://x.com/grok/status/2110078488610800027) > @gdb The hubris of ai spenders is thst they think $40k is cheap. A perdon could have found that for $4k. > — [A\_Eye\_Bubble on x](https://x.com/A_Eye_Bubble/status/2110163231746781341) > @gdb This is the part that actually matters: $40k of compute only turns into a full-chain vuln because someone built the harness that aims it, verifies it, triages it. The model is becoming the commodity. The loop around it is the product. > — [EricWangclaude on x](https://x.com/EricWangclaude/status/2110146436193251362) **Source threads** - [x](https://x.com/OpenAIDevs/status/2110063746542625033) · 0 points · 0 comments - [x](https://x.com/rohanpaul_ai/status/2110203596948353155) · 0 points · 19 comments - [x](https://x.com/gdb/status/2110063893016096831) · 0 points · 154 comments - [x](https://x.com/gdb/status/2110062860328165626) · 0 points · 9 comments ## Similar posts on daily.dev - [Claude Opus wrote a Chrome exploit for $2,283](https://daily.dev/posts/claude-opus-wrote-a-chrome-exploit-for-2-283-vrq54wsru) · The Register · 1 upvotes · 0 comments - [OpenAI was breached by a smarter model, not a new bug](https://daily.dev/posts/openai-was-breached-by-a-smarter-model-not-a-new-bug-bgdul0oun) · Kilo Blog · 0 upvotes · 0 comments - [Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25 › Searchlight Cyber](https://daily.dev/posts/exploit-brokers-pay-500-000-for-a-wordpress-rce-i-found-one-with-gpt5-6-sol-ultra-and-25-search-lgmv26dun) · Hacker News · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#google-chrome](https://daily.dev/tags/google-chrome), [#gpt](https://daily.dev/tags/gpt) [View this post on daily.dev](https://daily.dev/posts/40-000-of-gpt-5-6-compute-just-bought-a-250k-chrome-bounty-bvfge3w7i) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"$40,000 of GPT-5.6 compute just bought a $250K Chrome bounty","url":"https://daily.dev/posts/40-000-of-gpt-5-6-compute-just-bought-a-250k-chrome-bounty-bvfge3w7i","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/40-000-of-gpt-5-6-compute-just-bought-a-250k-chrome-bounty-bvfge3w7i"},"datePublished":"2026-10-14T02:59:13.726Z","dateModified":"2026-10-17T13:58:24.648Z","description":"An AI agent built on OpenAI's gpt-5.6-sol model, run by Xbow engineer Brendan Dolan-Gavitt against Chrome's source code, found a full-chain exploit crossing...","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/40-000-of-gpt-5-6-compute-just-bought-a-250k-chrome-bounty-bvfge3w7i","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,google-chrome,gpt","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"$40,000 of GPT-5.6 compute just bought a $250K Chrome bounty"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/40-000-of-gpt-5-6-compute-just-bought-a-250k-chrome-bounty-bvfge3w7i#faq","mainEntity":[{"@type":"Question","name":"how much did it cost to find the Chrome exploit that earned a $250,000 Google bug bounty","acceptedAnswer":{"@type":"Answer","text":"Roughly $40,000 in compute, using OpenAI's gpt-5.6-sol model run by Xbow engineer Brendan Dolan-Gavitt over about six days against Chrome's source code. The resulting exploit chain crossed two sandbox boundaries through three separate flaws, starting from ordinary JavaScript in a browser tab and ending with code execution outside the sandbox. Google reproduced the chain, confirmed all three bugs, and shipped fixes. Security teams weighing AI-assisted exploit hunting against traditional pentesting costs can track these economics on daily.dev."}},{"@type":"Question","name":"has Google ever paid a $250,000 full-chain Chrome bug bounty before","acceptedAnswer":{"@type":"Answer","text":"Yes, only once before, making this the second time in Chrome's history Google has paid a $250,000 full-chain bounty, and both times it went to Xbow. This particular payout was also Google's first full-chain Chrome bounty of 2026, for a bug class estimated to affect around 1 billion users. Anyone tracking browser security bounty trends can follow updates like this on daily.dev."}},{"@type":"Question","name":"what did the Shannon AI agent from KeyGraph find in a Kubernetes app","acceptedAnswer":{"@type":"Answer","text":"Shannon exploited eight real vulnerabilities in a personal Kubernetes-backed app in about three hours for roughly $2 in compute, including a stored XSS chain that stole a session token and read cluster secrets. It only reports bugs it has proven by actually exploiting them, avoiding the noise of speculative scanner findings. The tool is open source, while KeyGraph sells a hosted layer with dashboards and compliance features. Developers evaluating low-cost continuous AI pentesting tools can keep up with projects like this on daily.dev."}}]} ```