XBOW Pairs AI Agents with Researchers to Build Six-Day Chrome Sandbox Escape, Earning $250,000 Bounty
By dividing exploit engineering across specialized OpenAI model workflows and human supervisors, the security firm compressed a multi-month research cycle into less than a week.
Cybersecurity startup XBOW has documented a six-day exploit development campaign that produced a full Google Chrome sandbox escape using AI agents paired with human researchers, according to a technical post shared via Hacker News (https://xbow.com/labs/research/zero-to-calc-in-six-days-inside-xbow-chrome-full-chain). The multi-stage exploit crossed both V8 engine boundaries and operating system process protections to execute code outside the browser sandbox.
Google awarded the chain $250,000, representing the first full-chain payout under Chrome Vulnerability Reward Program rules introduced in April 2026. Prior to the adoption of large language models, building a comparable full-chain exploit typically required six to nine months for a four-person team, while XBOW's initial submission took two months and its latest campaign succeeded in six days.
Running from Sunday, August 2, through Friday, August 7, the project utilized OpenAI's gpt-5.6-sol model. Rather than relying on an individual agent to build an exploit end-to-end, XBOW divided the workflow into parallel sub-campaigns focused on broad vulnerability discovery, V8 memory corruption, V8 sandbox escapes, renderer sandbox escapes, and final chain integration. Reconstructed Codex logs placed total API charges for the six-day run at approximately $40,000.
Human researchers guided the campaign by picking target components, providing system context, auditing agent outputs, and defining modular interfaces between exploit stages so individual modules could be replaced without re-architecting the entire chain.
The exploit assembled three distinct vulnerabilities: a deoptimization flaw in V8's Maglev optimizing compiler to achieve arbitrary memory access within V8's 4 GiB memory cage; a time-of-check/time-of-use flaw in Blink's animated WebP decoding during detached ArrayBuffer transfers to escape the V8 cage; and an overflow in Chrome's Crashpad handler to break out of the host renderer sandbox and launch the Calculator application on signed Chrome Beta.
Google has addressed the underlying issues in Chromium and V8 through multiple patches, and XBOW plans to present the chronology and orchestration mechanics at the Unprompted conference at the end of October.
Sources
Written by
The Company Wire
Inside the companies building what’s next. Reporting on startups, technology, funding and the people shaping them.
