Xbow 用 GPT-5.6 拿下 Google 25 万美元 Chrome 全链漏洞赏金
Xbow 用 OpenAI 的 gpt-5.6-sol 六天花 4 万美元算力攻破 Chrome 沙箱，拿到 Google 首个 25 万美元全链赏金，安全行业薪资逻辑要变了。
Xbow 工程师 Brendan Dolan-Gavitt 使用 OpenAI 的 gpt-5.6-sol 模型，在六天、约 4 万美元算力成本下攻破 Chrome。智能体负责搜索代码、验证假设、编写利用链，工程师负责选定目标和整合各环节。最终利用链通过三个独立漏洞跨越两道沙箱边界，让网页 JavaScript 在沙箱外执行代码。Google 复现并修复了全部漏洞，按新规发放首个 25 万美元 Chrome 全链漏洞赏金。
GPT-5.6 helped break Chrome’s defenses for a $250,000 Google bounty.
Xbow engineer Brendan Dolan-Gavitt ran OpenAI’s gpt-5.6-sol, against the browser’s source code over six days and $40,000 of compute
The agents searched code, tested hypotheses, and drafted the exploit stages, while Dolan-Gavitt and colleagues picked targets, supplied context, and decided which pieces to join.
Reconstructing the Codex logs, Xbow put the compute bill at roughly $40,000, a fraction of the prize, and well below the months of specialist labor such work once demanded.
The finished chain turned ordinary JavaScript in a Chrome tab into code running outside every sandbox, crossing two protective boundaries through three separate flaws. Google reproduced the chain, confirmed all three bugs, shipped fixes, and awarded the first $250,000 full-chain Chrome reward under rules it set
