The awarded chain cost $40,000 in compute, and Google paid a $250,000 bounty. Those are the reported facts; the source is XBOW’s own account, not an independent audit.
Thesis
AI-assisted vulnerability research is becoming a faster human-led search loop, not yet demonstrated autonomous discovery.
Observed facts
XBOW says four researchers used GPT-5.6 Sol to build a Chrome full-chain exploit in six days.
1XBOW says Google awarded a $250,000 bounty and compute for the awarded chain cost $40,000.
1XBOW says Google had identified one bug in the initial chain; the researchers used prepared alternatives to build a replacement chain.
1XBOW says the three bugs in the chain have been fixed.
1
Mechanism
The model searched Chrome source code, tested ideas, built proofs of concept and drafted early exploit versions; researchers chose strategy, checked work and redirected the agents. Preparing alternative chain components let the team replace a bug Google already knew about.
Why now
XBOW has published its account of a high-impact chain and says the bugs are fixed, making the reported workflow and its limits relevant to defenders evaluating AI-assisted vulnerability research.
Implications
AI assistance can compress parts of vulnerability research, but the reported result depended on researcher direction, validation and prior work.
Defenders can apply similar search and testing to their own software, but must verify outputs and measure whether the loop yields fixes.
Evidence boundary
The timeline, model role, costs and bounty come from XBOW; the post does not independently establish reproducibility, comparative performance, or how often the method succeeds.
Watch conditions
Whether other teams reproduce this speedup on independently assessed targets, and whether defenders can turn it into a measurable increase in verified fixes.