On October 13, 2026, the security firm XBOW said Google paid it $250,000, the top reward in Chrome’s bug bounty program, for a full-chain exploit built with AI agents. XBOW says it took six days and about $40,000 in computing costs. Google has fixed all three bugs involved. But the six days were the last stretch of a longer effort, and humans did essential work. This article covers the economics, how much the AI did, and what defenders should change. It includes no exploit details.
What a Full Chain Is
Chrome protects users in layers. A bug in one layer usually lets an attacker go no further than a web page. A full chain joins several bugs to pass every layer, from a web page to the computer itself. XBOW’s chain used three: one in Chrome’s JavaScript engine, one in an image decoder, and one in the crash-reporting system.
Google pays up to $250,000 for such a chain under rules it updated in April 2026. XBOW says this was the first full-chain award under those rules and the second in Chrome’s history. It showed the chain on a test system running Chrome Beta.
How Much Did the AI Do?
XBOW says AI agents running OpenAI’s GPT-5.6 Sol model, which OpenAI released on July 9, 2026, searched Chrome’s source code, tested ideas, built proofs of concept, and drafted exploit stages. Humans chose targets, supplied context, challenged results, redirected searches, and decided which parts to join. The team split the work into parallel campaigns with narrow goals instead of asking one agent to build everything.
The six days were also the end of a longer process. XBOW says it set the challenge in January. Its first submission took two months. Its first version of this chain was disqualified because Google already knew about one of the bugs. The team had built each stage with a backup, so it could swap one in. It also reused techniques that its human team had written earlier. Four XBOW researchers took part, and Brendan Dolan-Gavitt built the final chain with the agents.
Dolan-Gavitt says this does not mean anyone with that time and money could do it. XBOW also predicts that within a year agents could find each of the three bugs on their own. That is a forecast, not something it showed.
The Economics
Spending $40,000 to win $250,000 looks like a bargain. But XBOW reconstructed the $40,000 from usage logs for the six-day campaign only. It does not cover researcher pay, the earlier chain, or other failed work. And only the first reporter is paid. Dolan-Gavitt writes that duplicates are now a major risk because many people point AI at Chrome. His team’s first full chain died when its last stage matched a bug Google had found internally. So the true cost of each paid chain is higher than $40,000. This is an editorial inference.
XBOW says a pre-AI chain would have taken a team of four six to nine months. That is XBOW’s own estimate. The direction still matters. In Dolan-Gavitt’s words, six days and $40,000 is not much when the payoff is a Chrome chain. The bar is lower.
What Is Confirmed and What Is Not
Some parts can be checked. XBOW points to public Chromium tracker entries and fixes for each bug, and says Google confirmed the chain worked. No public Google statement about the award was found. Other parts rest on XBOW’s word: the $40,000, the six days, the estimate of a billion affected users, and how much the AI did. One CVE number that circulated with this story belongs to a different Chrome V8 race condition, so it is not used here.
A Different Google Program
In the same month, Google stopped taking new product bug reports for its open-source bug bounty, the OSS VRP, on October 1. It said a significant rise in automated submissions had been mostly invalid. It promised an update in the first quarter of 2027. These are separate programs. Google pays for working proof against a real release, and it blocks unproven volume.
What Defenders Should Change
XBOW’s advice is plain. Keep Chrome current, and relaunch it, because an update only takes effect after a restart. Test your own software before someone else does. Assume some bugs will slip through, and plan for attacks that get past your defenses.
If finding serious bugs gets cheaper for everyone, patch windows matter more. Make sure browsers actually restart after updates, and layer defenses so one bug is not enough.
What Could Come Next
In the near term, expect more AI-assisted submissions, more duplicates, and tighter rules at bounty programs. XBOW plans to share the full chronology at a conference at the end of October.
The long-term picture is speculation. If XBOW’s forecast holds, the gap between a bug being found and being exploited will keep shrinking, and defenders will have to shrink the gap between a bug being found and being fixed.
If the editor flags the line about the April 2026 rules, add “according to XBOW” to the sentence that begins “Google pays up to $250,000.” That claim comes from XBOW and news coverage, not from Google’s own rules page.
