GoKawiilXBOW built a $250,000 Chrome full-chain exploit in six days using AI agents
XBOW developed a Chrome full-chain exploit combining a V8 compiler bug, an animated-WebP decoder bug, and a Crashpad memory-safety flaw, enabling code execution outside the renderer sandbox from a single web page. Google awarded it the first $250,000 payout under Chrome's new full-chain VRP rules introduced in April 2026. The chain was produced in six days by AI agents running OpenAI's gpt-5.6-sol model, guided by human researchers, at an estimated API cost of $40,000.