XBOW 用 GPT-5.6 Sol 花 6 天找到 Chrome 全链漏洞，获 Google 25 万美元赏金
XBOW 拿 GPT-5.6 Sol 花了 6 天和 4 万美元算力就拿下 Chrome 全链漏洞，拿到 Google 25 万美元赏金，以前情报机构干这活要 6 个月，防守方真得抓紧自查了。
安全公司 XBOW 使用 OpenAI 的 GPT-5.6 Sol 模型，仅用 6 天和约 4 万美元算力构造出 Chrome 的全链漏洞利用，获得 Google 2026 年新规下首笔 25 万美元全链赏金。该漏洞影响 Windows 上约 10 亿 Chrome 用户，攻击者无需钓鱼即可通过访问恶意网站完全控制机器。团队原以为失败的首次提交后，在拉斯维加斯的 Black Hat 期间用 6 天重建了新利用链。一位情报机构老兵表示这类漏洞过去需要 6 个月人工投入。XBOW 正在开发针对桌面软件和嵌入式设备的自动化测试产品。
6 days and $40,000 of compute with GPT-5.6 Sol to find a critical vulnerability in Chrome, claiming Google’s first full-chain reward in 2026 for a vulnerability that would affect an estimated 1 billion users. Highlights the opportunity for defenders to utilize these tools to secure their software to unprecedented levels: Oege de Moor @oegerikus For the second time in Google Chrome’s history, Google awarded a $250,000 bounty for a full-chain exploit… to @XBOW . Here’s the full story: At an all-hands at the start of 2026 in Malta, I set the team a crazy challenge. A full-chain exploit of Chrome by the annual Black Hat cybersecurity conference in August. I believed there were few better tests of whether @XBOW could move beyond web applications to desktop software, servers and devices. Chrome is one of the most hardened pieces of software on the planet, used by more than half the world’s population. A full-chain exploit lets an attacker take total control of a machine, where they can read every email, password and bank login the user types. You don’t need to download anything or click a phishing link. Visiting the wrong site is enough. So @moyix , Andres Luksenberg, Baul Lee, and Willem Pinckaers took on the challenge along with a fifth teammate: OpenAI's GPT-5.6 Sol. They built a chain they thought would win, but Google told us they already knew one of the bugs. We were already in Las Vegas for Black Hat and DEF CON, and the team didn’t want to go home without the win. So Brendan and the agents built a new exploit in just 6 days. We submitted it to Google and waited. The news came through that we'd done what should’ve been impossible. A full-chain bounty of $250,000, the first awarded under Google’s 2026 rules. It took just 6 days and $40,000 of compute to construct an exploit that affects a billion users of Chrome on Windows. An intelligence-agency veteran told me his team used to spend 6 months on this kind of vulnerability. My takeaway: the cost of finding truly critical vulnerabilities is collapsing, for attackers and defenders alike. Restricting powerful models is not the answer; GPT-5.6 Sol is already public. But defenders have one advantage attackers never will: they can test their own code first. Assume your software is exploitable. Whoever is hunting your bugs has the same building blocks we did. This is cause for urgency but not panic. XBOW is now developing an autonomous product for testing compiled software (desktop applications, servers, embedded devices), and partnering with the world’s top organizations to design that product. If you’d like to be one of them, get in touch. P.S. Restart Chrome whenever the Update button appears! 🔗 View Quoted Tweet 💬 69 🔄 38 ❤️ 664 👀 38633 📊 99 ⚡
