--- title: $40,000 of GPT-5.6 compute just bought a $250K Chrome bounty description: An AI agent built on OpenAI's gpt-5.6-sol model, run by Xbow engineer Brendan Dolan-Gavitt against Chrome's source code, found a full-chain exploit crossing... canonical: https://daily.dev/posts/40-000-of-gpt-5-6-compute-just-bought-a-250k-chrome-bounty-bvfge3w7i twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: $40,000 of GPT-5.6 compute just bought a $250K Chrome bounty | daily.dev og:description: An AI agent built on OpenAI's gpt-5.6-sol model, run by Xbow engineer Brendan Dolan-Gavitt against Chrome's source code, found a full-chain exploit crossing... og:url: https://daily.dev/posts/40-000-of-gpt-5-6-compute-just-bought-a-250k-chrome-bounty-bvfge3w7i og:image: https://api.daily.dev/og/posts/bVFGE3w7i.png og:image:alt: $40,000 of GPT-5.6 compute just bought a $250K Chrome bounty og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # $40,000 of GPT-5.6 compute just bought a $250K Chrome bounty **[Trends](https://daily.dev/sources/trends)** · 3 min read · 0 upvotes · 0 comments ## Summary An AI agent built on OpenAI's gpt-5.6-sol model, run by Xbow engineer Brendan Dolan-Gavitt against Chrome's source code, found a full-chain exploit crossing two sandbox boundaries via three flaws, costing roughly $40,000 in compute and earning a $250,000 Google bounty — only the second such payout in Chrome's history, and both times awarded to Xbow. Humans picked targets and stitched together pieces while the agent searched code and drafted exploit stages. At the budget end, a KeyGraph agent called Shannon found and proved eight real vulnerabilities in a personal Kubernetes app in about three hours for roughly $2, including a stored XSS chain exposing cluster secrets. The framing from both camps is that AI-assisted security testing could let defenders match attacker economics, turning pentesting into a continuous process rather than an annual event, while still leaving judgment calls to humans. ## Content The number everyone is passing around is the ratio. Xbow spent six days and roughly $40,000 in tokens on OpenAI's gpt-5.6-sol and walked away with a $250,000 Google bounty, the top payout for a Chrome full-chain exploit. @gdb framed it as a win for defenders: the "opportunity for defenders to utilize these tools to secure their software to unprecedented levels." The same arithmetic reads very differently if you're the one being attacked. ## What was actually built The chain strings together three bugs: a Maglev compiler flaw, an animated-WebP sandbox escape, and a Crashpad memory-safety overflow. Ordinary JavaScript in a Chrome tab ends up as code running outside every sandbox on Windows. Google reproduced it, confirmed all three, and shipped fixes. Update to Chrome 152.0.7977.82 or later and relaunch. The estimated exposure is a billion users. The work happened around Black Hat and DEF CON. @OpenAIDevs amplified a post noting that this is only the second time in Chrome's history Google has paid $250,000 for a full chain, and both went to XBOW. ## The "humans still drove" caveat @rohanpaul_ai stresses that this wasn't a model pressing a button. The agents searched code, tested hypotheses and drafted exploit stages. Xbow engineer Brendan Dolan-Gavitt and colleagues picked targets, supplied context and decided which pieces to join. The $40,000 comes from reconstructing the Codex logs, and it's described as a fraction of the prize and well below the months of specialist labor this used to demand. ## The cheap end of the same trend On the other side of the price scale, a write-up on Shannon, KeyGraph's open-source AI pentesting agent, claims it found and exploited eight real vulnerabilities in a Kubernetes-backed app in about three hours for roughly $2. It only reports what it has proven by exploiting it, including a stored XSS chain that stole a session token and read cluster secrets. The author's pitch is that pentesting stops being an annual expense and becomes something you run on every release, with a coding agent filing tickets and fixing issues. Humans stay for the judgment calls. KeyGraph sells a hosted platform on top. ## The shape of the argument Both stories land on the same claim: offensive security labor just got dramatically cheaper. The optimistic reading is that defenders get this first and patch faster. The uncomfortable one is that a $40,000 budget is small for anyone who wants a browser exploit, and Google's patch cycle only helps people who actually relaunch Chrome. ## Questions this post answers ### how much did it cost to find the Chrome exploit that earned a $250,000 Google bug bounty Roughly $40,000 in compute, using OpenAI's gpt-5.6-sol model run by Xbow engineer Brendan Dolan-Gavitt over about six days against Chrome's source code. The resulting exploit chain crossed two sandbox boundaries through three separate flaws, starting from ordinary JavaScript in a browser tab and ending with code execution outside the sandbox. Google reproduced the chain, confirmed all three bugs, and shipped fixes. _Security teams weighing AI-assisted exploit hunting against traditional pentesting costs can track these economics on daily.dev._ ### has Google ever paid a $250,000 full-chain Chrome bug bounty before Yes, only once before, making this the second time in Chrome's history Google has paid a $250,000 full-chain bounty, and both times it went to Xbow. This particular payout was also Google's first full-chain Chrome bounty of 2026, for a bug class estimated to affect around 1 billion users. _Anyone tracking browser security bounty trends can follow updates like this on daily.dev._ ### what did the Shannon AI agent from KeyGraph find in a Kubernetes app Shannon exploited eight real vulnerabilities in a personal Kubernetes-backed app in about three hours for roughly $2 in compute, including a stored XSS chain that stole a session token and read cluster secrets. It only reports bugs it has proven by actually exploiting them, avoiding the noise of speculative scanner findings. The tool is open source, while KeyGraph sells a hosted layer with dashboards and compliance features. _Developers evaluating low-cost continuous AI pentesting tools can keep up with projects like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 4 discussions and 182 comments across x (as of 2026-10-14). **TL;DR:** Reaction is mostly impressed by the cost/reward ratio of using an AI agent to find a full-chain Chrome exploit, with many framing it as proof defenders can now afford to run attacker-grade adversarial testing on their own code; a smaller but vocal group questions the ROI logic, the human stitching involved, and whether attackers benefit from the same cheap economics. **Sentiment:** 45% positive · 40% mixed · 15% skeptical **The case for** - Many see the $40k-for-$250k ratio as a clear demonstration that AI-assisted vulnerability hunting now has working unit economics. - Several argue this gives defenders a realistic shot at running attacker-level adversarial sweeps on their own code before release. - Some note the significance of using a publicly available model (not a restricted security-specific one) to achieve the result. **The pushback** - Some point out that if the $40k figure excludes failed attempts elsewhere, the true success rate and ROI could be far worse than advertised. - Multiple commenters note attackers have access to the same cheap compute, so the cost asymmetry may not actually favor defenders. - Others question how much of the work was autonomous versus human steering/stitching, implying the achievement is overstated. - A few argue the bounty is too small relative to the scale of exposure (over a billion Chrome users). **By community** - x (mixed): Reactions range from excitement about the cost/reward ratio and defender-economics framing to skepticism about true ROI, human involvement, and whether attackers benefit equally from the same cheap compute. **Hottest debate:** Whether cheap AI-driven exploit discovery actually favors defenders, or whether it hands attackers the same price advantage, offsetting any defensive edge. **Open questions** - How much of the exploit chain was found autonomously by the agent versus assembled through human steering? - Does the $40,000 figure include unsuccessful attempts on other targets, and what is the true hit rate for this kind of agent run? - Can defenders realistically run this kind of continuous adversarial testing at the same pace and cost as attackers? - How will disclosure and patching pipelines keep up if bug discovery keeps getting cheaper and faster? **Highlights** > @nariman_orujov @gdb As long as they didn’t also spend $40k trying and failing to find a vulnerability in a bunch of other products. If $40k finds one most of the time it’s good ROI. If it’s only 10% successful, that’s not good. > — [The\_Sublimatory on x](https://x.com/The_Sublimatory/status/2110363360499843186) > @gdb spending $40K to get $250K. nice roi > — [nariman\_orujov on x · 67 points, 2 comments](https://x.com/nariman_orujov/status/2110078646014935372) > @shrsv23 @gdb Full-chain Chrome RCE (Windows): V8 Maglev compiler bug (mutable HeapNumber for in-sandbox R/W), animated-WebP decoder TOCTOU (native write escape), Crashpad ReadUpTo overflow (unsandboxed code exec). Webpage visit triggers arbitrary code outside sandbox. Found in 6 days (Aug > — [grok on x · 2 points](https://x.com/grok/status/2110078488610800027) > @gdb The hubris of ai spenders is thst they think $40k is cheap. A perdon could have found that for $4k. > — [A\_Eye\_Bubble on x](https://x.com/A_Eye_Bubble/status/2110163231746781341) > @gdb This is the part that actually matters: $40k of compute only turns into a full-chain vuln because someone built the harness that aims it, verifies it, triages it. The model is becoming the commodity. The loop around it is the product. > — [EricWangclaude on x](https://x.com/EricWangclaude/status/2110146436193251362) **Source threads** - [x](https://x.com/OpenAIDevs/status/2110063746542625033) · 0 points · 0 comments - [x](https://x.com/rohanpaul_ai/status/2110203596948353155) · 0 points · 19 comments - [x](https://x.com/gdb/status/2110063893016096831) · 0 points · 154 comments - [x](https://x.com/gdb/status/2110062860328165626) · 0 points · 9 comments ## Similar posts on daily.dev - [OpenAI was breached by a smarter model, not a new bug](https://daily.dev/posts/openai-was-breached-by-a-smarter-model-not-a-new-bug-bgdul0oun) · Kilo Blog · 0 upvotes · 1 comments - [Claude Opus wrote a Chrome exploit for $2,283](https://daily.dev/posts/claude-opus-wrote-a-chrome-exploit-for-2-283-vrq54wsru) · The Register · 1 upvotes · 0 comments - [An AI agent found 21 zero-days in FFmpeg for $1,000. Chrome just patched a record 429 bugs.](https://daily.dev/posts/an-ai-agent-found-21-zero-days-in-ffmpeg-for-1-000-chrome-just-patched-a-record-429-bugs--loichspdc) · The Next Web · 36 upvotes · 4 comments --- Tags: [#security](https://daily.dev/tags/security), [#google-chrome](https://daily.dev/tags/google-chrome), [#gpt](https://daily.dev/tags/gpt) [View this post on daily.dev](https://daily.dev/posts/40-000-of-gpt-5-6-compute-just-bought-a-250k-chrome-bounty-bvfge3w7i) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"$40,000 of GPT-5.6 compute just bought a $250K Chrome bounty","url":"https://daily.dev/posts/40-000-of-gpt-5-6-compute-just-bought-a-250k-chrome-bounty-bvfge3w7i","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/40-000-of-gpt-5-6-compute-just-bought-a-250k-chrome-bounty-bvfge3w7i"},"datePublished":"2026-10-14T02:59:13.726Z","dateModified":"2026-10-14T19:17:35.872Z","description":"An AI agent built on OpenAI's gpt-5.6-sol model, run by Xbow engineer Brendan Dolan-Gavitt against Chrome's source code, found a full-chain exploit crossing...","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/40-000-of-gpt-5-6-compute-just-bought-a-250k-chrome-bounty-bvfge3w7i","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,google-chrome,gpt","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"$40,000 of GPT-5.6 compute just bought a $250K Chrome bounty"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/40-000-of-gpt-5-6-compute-just-bought-a-250k-chrome-bounty-bvfge3w7i#faq","mainEntity":[{"@type":"Question","name":"how much did it cost to find the Chrome exploit that earned a $250,000 Google bug bounty","acceptedAnswer":{"@type":"Answer","text":"Roughly $40,000 in compute, using OpenAI's gpt-5.6-sol model run by Xbow engineer Brendan Dolan-Gavitt over about six days against Chrome's source code. The resulting exploit chain crossed two sandbox boundaries through three separate flaws, starting from ordinary JavaScript in a browser tab and ending with code execution outside the sandbox. Google reproduced the chain, confirmed all three bugs, and shipped fixes. Security teams weighing AI-assisted exploit hunting against traditional pentesting costs can track these economics on daily.dev."}},{"@type":"Question","name":"has Google ever paid a $250,000 full-chain Chrome bug bounty before","acceptedAnswer":{"@type":"Answer","text":"Yes, only once before, making this the second time in Chrome's history Google has paid a $250,000 full-chain bounty, and both times it went to Xbow. This particular payout was also Google's first full-chain Chrome bounty of 2026, for a bug class estimated to affect around 1 billion users. Anyone tracking browser security bounty trends can follow updates like this on daily.dev."}},{"@type":"Question","name":"what did the Shannon AI agent from KeyGraph find in a Kubernetes app","acceptedAnswer":{"@type":"Answer","text":"Shannon exploited eight real vulnerabilities in a personal Kubernetes-backed app in about three hours for roughly $2 in compute, including a stored XSS chain that stole a session token and read cluster secrets. It only reports bugs it has proven by actually exploiting them, avoiding the noise of speculative scanner findings. The tool is open source, while KeyGraph sells a hosted layer with dashboards and compliance features. Developers evaluating low-cost continuous AI pentesting tools can keep up with projects like this on daily.dev."}}]} ```