Xbow reports GPT-5.6-assisted chain of three Chrome vulnerabilities
Forbes reports that Xbow engineer Brendan Dolan-Gavitt used OpenAI’s publicly available GPT-5.6 model to help develop a chain combining three previously unpatched Chrome vulnerabilities. The work reportedly consumed about $40,000 in tokens. Google confirmed the findings and awarded Dolan-Gavitt its maximum $250,000 bounty, according to the report.
The account describes a human-directed security research effort, not an autonomous model operation. Forbes says Xbow is awaiting Google’s review of two additional model-generated exploits; their status remains unresolved in the source. The report frames the case as evidence that defenders and attackers can access increasingly capable tools, but does not establish broader prevalence or independently characterize the model’s contribution.