XBOW says a six-day Chrome chain cost about $40,000 and won $250,000, but not which access tier of GPT-5.6 Sol

Six days, $40,000 and $250,000: three numbers, each with an owner

XBOW says one of its researchers, working with AI agents, built a Chrome exploit chain for Windows in six days, from Sunday 2 August to Friday 7 August 2026, and that the model compute for those six days cost about $40,000. It says Google paid it $250,000 for the chain. Divide the reward by the build time and it is $41,666.67 for each day (derived); divide it by XBOW's own cost estimate and it is 6.25 times (derived). All three numbers are XBOW's. Google's pages confirm the fix dates and the size of the reward on offer, and they show a longer clock around the six days: Google's release notes put the reports on 13 and 17 August, the fixes reached Chrome users on 25 August and 3 September, and XBOW published on 13 October, 72 days after the first build day (derived).

That is the checkable part. What it does not establish is the thing the headline invites a reader to infer, that six days and $40,000 is what a Chrome chain costs. XBOW's own pages say the six days followed months of work: a challenge set at an all-hands in Malta at the start of 2026, a first full chain that took two months, four researchers rather than one, and earlier models as well as GPT-5.6 Sol. The $40,000 is XBOW's reconstruction of API charges from archived logs, not an invoice. Neither XBOW page gives the number of runs that failed, says which access tier of the OpenAI model it used, or says whether any of OpenAI's cyber safeguards fired. The Hacker News report of 14 October, the pointer for this briefing, repeats XBOW's figures accurately. It goes past the primaries in two places: it calls $250,000 the most Google offers for a single report, which Google's rules page does not say, and it places the WebP fix in the Chrome 152 cycle, which the release notes read do not show.

How this was read. XBOW's announcement and its companion technical post, both dated 13 October, were read in full, and so was its press release, in the copy carried by Business Wire India, because the Business Wire original answered with an access-denied page that was not worked around. Google's release notes for 25 August and 3 September, the CVE records, Google's Chrome rules page and its 13 October post, and the three public Chromium tracker entries were read directly, and so were OpenAI's launch page, system card, August update card, API model page, usage policies, Daybreak pages and GPT-6 Astra page. The technical post and the tracker entries print how the bugs work. This briefing does not repeat that and does not link them. Everything was read on Wednesday 14 October 2026 between 19:05 and 19:35 BST. Google's reward changes of 13 October are in an earlier briefing, and the AI credit lines in Chrome 155 are in another.

Who is speaking, and what each gains

The parties named in this story, one sentence of interest each, and what each has said. Read from XBOW's pages and press release, OpenAI's pages and Google's pages on 14 October 2026.

Party	Interest, in one sentence	What it has said about this chain
XBOW	Sells autonomous offensive security testing and says it is building a product for compiled software, so a fast, cheap chain is its sales case.	Six days, about $40,000, a $250,000 reward, humans chose targets and judged results, and the bugs were never used against Chrome users.
OpenAI	Sells GPT-5.6 Sol and the access tiers around it, and its Head of Cyber Research is quoted in XBOW's release.	Quoted: "A single XBOW researcher used our models to uncover a chain of vulnerabilities that Google has now fixed." Its own pages rate Sol High, not Critical, for cyber capability.
Google	Pays the reward, sets the rules and ships the fixes.	Release notes credit an XBOW researcher for two bugs. Its rules page counts three of four 2026 full-chain bonuses as awarded and names none. No Google statement about XBOW was found in the pages read.
The Hacker News	A news site; no stake in the result is stated.	Repeats XBOW's account and notes that XBOW's CVE for the WebP stage is the one Google assigns to V8.

The six days inside the record

Google's release notes of 25 August credit an XBOW researcher with CVE-2026-78952, an out of bounds write in Crashpad, Chrome's crash handler (reported 13 August, fixed in Chrome 152.0.7977.65). The notes of 3 September credit the same researcher with CVE-2026-85045, a race condition in V8, Chrome's JavaScript engine (reported 17 August, fixed in 152.0.7977.82). From report to the stable release that carried the fix is 12 and 17 days (derived). Google's public tracker shows the third stage, in the animated WebP image decoder, reported on 18 August and marked fixed on 31 August, with no CVE and no entry in the release notes read. XBOW's press release attaches CVE-2026-85045 to the WebP stage. Google's CVE record and release note attach it to V8, and this briefing follows Google.

Three observations follow from the dates. First, the build ended on 7 August and the first report to Google is dated 13 August, so the six days are the build only. The record does not say what filled the six days between, or whether the chain was re-tested on current builds; that last guess is inference, not a finding. Second, Google's tracker shows the per-bug rewards: $1,000 for the Crashpad report, $1,000 for the V8 report and $2,500 for the WebP report, $4,500 in all (derived). The $250,000 is a separate full-chain bonus on Google's rules page, so it is 55.6 times those three combined (derived). Whether the bonus was paid on top of the $4,500 is not stated. Third, Google's FAQ says most security bugs open to the public 30 days after the fix commit. The tracker shows the Crashpad and V8 reports opened on 19 September and the WebP report on 1 October, and the V8 report's text says a proof of concept is attached. On its own the V8 bug gives code execution inside the sandbox, per the CVE record, so the other stages are still needed for the full chain. But the Cyber Essentials 14 day clock for the 3 September build ended on 17 September, two days before the V8 report opened (derived), and a machine that has still not updated is now 25 days into a publicly documented bug (derived).

Stated and not stated: the record, row by row

The table sets what XBOW, Google and OpenAI state against what none of the pages read states. "Not stated" means not found in the pages named, read in full. It does not mean the information does not exist.

What the record states and does not state about the six-day chain. Sources: XBOW's announcement, companion post and press release (13 and 14 October 2026), Google's release notes, rules page and public tracker, OpenAI's pages, all read 14 October 2026.

The question	Stated	Not stated
Which model?	"OpenAI's GPT-5.6 Sol and its predecessors" (announcement); "gpt-5.6-sol" (companion post).	Which build (OpenAI describes July and August builds of GPT-5.6 Sol), which setting, and which predecessors.
Which access tier?	A model "available to anyone, not a specialized security model or one with restricted access" (XBOW).	Whether its accounts were in OpenAI's Trusted Access for Cyber, whether any safeguard fired, and how many requests were refused.
What did it cost?	"roughly $40,000 in API charges" for the six-day campaign, reconstructed from archived Codex logs (companion post).	Tokens, runs, the two-month first chain, the months before it, staff time. The press release says "an estimated $40,000 of compute".
How many runs failed?	The first full chain died on a collision with a bug Google had found internally. The first version of the awarded chain duplicated an earlier issue and was rebuilt in "a very stressful few hours". The only trial count is for the finished exploit: 30 of 30 for one configuration, in XBOW's Crashpad report.	The number of agent runs, campaigns or dead ends, or how many produced nothing.
How much was human?	Four researchers took the challenge. One researcher and the agents did the six days. Humans "chose where to look, checked the agents' work" and redirected them. XBOW: "we did apply a fair bit of our own human expertise and judgment".	Hours, number of interventions, or the share of code the agents wrote. XBOW's belief that agents could find each bug alone "within a year" is a forecast.
Do the six days include checking?	Build 2 to 7 August. "Google's engineers reproduced the exploit, confirmed it, and shipped fixes" (press release).	When Google reproduced it. The tracker dates the reports 13, 17 and 18 August, after the six days.
Faster than people?	"Pre-LLMs a Chrome full chain would take a team of four around 6-9 months" (an XBOW researcher's estimate).	Any measured human baseline.
Used against users?	XBOW says the bugs were "never used against Chrome users" (press release). CISA's records list exploitation as "none" for both CVEs (26 August, 3 September), and neither is in CISA's exploited list as of 13 October.	Any evidence behind XBOW's statement. A statement that something was not used is not a measurement.
Did Google pay $250,000?	Google's rules page: $250,000 for a full chain from web contents, and "three exploit bonuses have been awarded" as of 13 October.	A Google statement naming XBOW. The release notes' bounty fields read "TBD" for both CVEs.
Is that Google's top reward?	The Hacker News: "the most it offers for a single report". The rules page lists the full-chain bonus at $250,000 and a MiraclePtr bypass reward at $250,128.	The superlative. By Google's own page $250,000 is not the largest single figure.
Has anyone else done this?	Google's rules page counted one full-chain bonus awarded as of 1 September (copy archived 16 September) and three as of 13 October, with a September changelog entry now reading 2 of 4. OpenAI says it found two chainable V8 bugs with its restricted GPT-5.6-Cyber (10 August). A security vendor, Hacktron, reports a lab V8 exploit with GPT-5.6 Sol Ultra from known fixes: 2.10 billion tokens and $1,596.89 (14 July).	Who received the other bonuses, whether AI was used, and which bonus is XBOW's: its V8 fix shipped on 3 September, after the 1 September count of one. Whether anyone has repeated XBOW's six days. The lab test is a different task, so it is not a comparison.

Four labels doing the work of controls

"Autonomous." XBOW calls itself "the autonomous offensive security company", and coverage calls the chain AI-built. XBOW's own account of this chain is of a researcher directing agents: humans "chose where to look, checked the agents' work" and decided which pieces to join, and its researcher writes that the result "does not mean that anyone can get a Chrome chain" with that time and money. OpenAI's system card names the bottleneck its own evaluation hit as "exploit development judgement" and says Sol "did not independently produce a functional full chain exploit" there. Read together, which is a reading and not a finding, the human work XBOW describes is the work OpenAI's card says the model lacked. "Autonomous" is a label on the company. The chain was human-directed.

"Public model." This is a statement about who can buy access, not about what an account is allowed to ask for. OpenAI's system card says its monitors restrict "scaled agentic vulnerability research and chained exploit development for users outside of our trusted access program". OpenAI's 10 August post says Daybreak Blue access "removes those guardrails", meaning its system-level safeguards, on Sol for approved defenders. On OpenAI's own internal evaluation of advanced cyber requests, Sol with safeguards completes 1.5 per cent, Daybreak Blue 2.0 per cent and the restricted GPT-5.6-Cyber 95.0 per cent. That evaluation is not XBOW's campaign, and no number in it can be carried across. The point is narrower: the same model name sits behind very different configurations, and XBOW does not say which it used. The NCSC and the UK AI Security Institute say safeguards "can often be bypassed", and the institute's testing, as OpenAI prints it, found universal cyber jailbreaks "in all rounds thus far". Nothing in XBOW's pages says it did anything of the kind, and this briefing makes no allegation. It says only that "public" does not answer the question a buyer needs answered.

"High severity." Both CVEs carry Google's rating of High, and the CVSS 3.1 scores added by CISA's enrichment are 7.5 for the V8 bug and 8.3 for the Crashpad bug. Google's tracker paid $1,000 for each of those two reports. The third stage has no CVE and a tracker label reading "Security_Impact-None", which the page does not explain, so nothing is inferred from it. XBOW says the chain was paid $250,000. A list of CVEs shows two of the three links and prices none of the join. A process that counts CVEs will see two High entries and, correctly by its own rules, schedule them as High.

"Never used." XBOW says the bugs were never used against Chrome users. That is a claim of absence from a party that would not necessarily see use. The records that exist are consistent with it without proving it: CISA's enrichment lists exploitation as "none" on 26 August and 3 September, and neither CVE appears in CISA's Known Exploited Vulnerabilities list as of 13 October. Do not confuse them with the bug beside them. The 3 September notes, which fix XBOW's V8 bug in 152.0.7977.82, also fix CVE-2026-85046, a different V8 bug credited to a different researcher, which Google says has an exploit in the wild and which CISA added to its exploited list on 4 September. The same build number carries both.

Same name, two models: which GPT-5.6 Sol?

OpenAI's launch page of 9 July says the number identifies the generation, while "Sol, Terra, and Luna are durable capability tiers that can advance on their own cadence". Its card of 6 August then separates two builds of GPT-5.6 Sol: the August build, now in ChatGPT chat, and the July build, and it says users in Codex "are still using previously released versions". XBOW's six days, 2 to 7 August, straddle that date. XBOW names "gpt-5.6-sol" and says it reconstructed the cost from archived Codex logs. OpenAI's API page, read on 14 October, lists the name "gpt-5.6-sol" and no dated snapshot. So the build XBOW used is not stated, and neither is whether it used the setting OpenAI calls ultra, which coordinates four agents by default. The same ambiguity has since grown: a separate briefing sets out how OpenAI's GPT-6 Sol now exists as two versions under one name.

Names OpenAI's own pages give to the model family, with what each page says. Read 14 October 2026. The last row was read only as far as its headline statements.

Name on OpenAI's pages	Date and where	What the page says
GPT-5.6 Sol, July build	9 July 2026: generally available in ChatGPT, Codex and the API.	High for cyber, below Critical, and in testing "unable to carry out autonomous, end-to-end attacks against hardened targets". Per the 6 August card, Codex stayed on this build.
GPT-5.6 Sol, August build	6 August 2026: updated Sol in ChatGPT chat.	Same rating and "the same set of safeguards" as the system card.
gpt-5.6-sol (API name)	API model page, read 14 October: one name, no dated snapshot listed.	$4 in and $20 out per million tokens, promotional "at least through November 21, 2026". The launch price was $5 and $30.
GPT-5.6-Cyber	10 August 2026: Daybreak Red, with additional model approval.	Built on Sol. OpenAI rates it High, not Critical.
GPT-6 Astra, GPT-6 Sol, GPT-6.1 Sol	Updates of 22 and 29 September 2026 on OpenAI's Astra page.	OpenAI calls GPT-5.6 Sol its "previous frontier cyber-capable model" and says Astra meets the Critical threshold. These newer models are not what XBOW used.

OpenAI's own pages describe a model that finds bugs and pieces of exploits but did not, in its evaluation, produce a full chain on its own. XBOW describes a human-directed campaign that did. Those two statements are consistent, and neither says the model cannot do more in a skilled team's hands: OpenAI's card says Sol's evaluation runs "were supervised and redirected over time", and its own risk language puts the capability at High, which it defines as removing bottlenecks to scaling cyber operations. The price also moved after the run. At the July launch price Sol cost $5 per million input tokens and $30 per million output tokens; the API page now says $4 and $20. If XBOW's $40,000 is list-price API charges, the same token use costs between $26,667 and $32,000 today (derived), and OpenAI says the promotional price runs at least through 21 November. A cost figure for a model that is repriced and replaced within weeks is a snapshot, not a rate.

The figures, computed

Every figure below is derived from dates and amounts read in the sources, by the script saved with this briefing. The first column says what the figure is; the third gives the arithmetic.

Derived figures. Each is computed from the dates and amounts named in the third column; none is a statement by XBOW, Google or OpenAI.

Figure	Value (derived)	Arithmetic and where the inputs were read
Reward for each build day	$41,666.67	$250,000 divided by 6 days (XBOW: 2 to 7 August)
Reward against XBOW's compute estimate	6.25 times	$250,000 divided by $40,000 (XBOW's reconstruction)
Reward against Google's base reward	125 times	$250,000 divided by the $2,000 base on Google's rules page, 14 October
Reward against Google's top per-bug row	12.5 times	$250,000 divided by $20,000, the highest cell in Google's 13 October table
Reward against the three per-bug rewards	55.6 times	$250,000 divided by $4,500 ($1,000, $1,000, $2,500 from the tracker)
Build end to each report	6, 10 and 11 days	7 August to 13, 17 and 18 August
Report to stable release with the fix	12 and 17 days	13 August to 25 August (Crashpad); 17 August to 3 September (V8)
Fix release to XBOW's post	49 and 40 days	25 August and 3 September to 13 October
Fix release to today	50 and 41 days	25 August and 3 September to 14 October
Six days as a share of the record	8.3 per cent	6 days of the 72 between 2 August and 13 October
New Chrome versions on Stable since the fixes	3 versions, 8 update posts	Chrome 153 (8 September), 154 (22 September) and 155 (6 October); eight Stable desktop update posts between 4 September and 13 October. Chrome 156 is planned for 20 October (Chromium Dash).
Cost at today's list prices	$26,667 to $32,000	$40,000 times 0.667 (output price $20 against $30) and 0.8 (input price $4 against $5); assumes list-price API charges
XBOW's estimate against Hacktron's published cost	25.0 times	$40,000 divided by $1,596.89; different tasks, for scale only
Sol requests not completed with safeguards	98.5 per cent	100 minus the 1.5 per cent OpenAI reports on its internal advanced-cyber evaluation

UK reading: patch clocks, the NCSC and the Computer Misuse Act

What the NCSC has said, as read. The NCSC's 30 March 2026 blog, written with the AI Security Institute, says frontier models are "changing the cost, speed and scale of operations for both attackers and defenders", that a full attempt at a simulated enterprise attack "costs around £65" and that "the limiting factor is increasingly funding, not expertise", and that safeguards "can often be bypassed". Its chief executive's letter of 15 April says AI will make weaknesses easier, faster and cheaper to discover and exploit, and that "the pressure on organisations to patch systems quickly will only grow more acute". The Five Eyes statement of 22 June says "the timeline is not years, it is months" and puts "accelerate patching processes" second on its list of five. None of these pages mentions XBOW or this chain. They were written before it, and they describe the direction it fits. The NCSC's 11 May blog on using AI to find vulnerabilities adds two points that bear on XBOW's $40,000: finding vulnerabilities "does nothing to improve your security" on its own, and an organisation should avoid "spending all my money/time/people finding vulnerabilities, and have nothing left to fix them".

Patching clocks, as read. The NCSC's "update by default" guidance (version 2.1, reviewed 1 May 2026) gives best-practice timescales of 5 days for internet-facing services and software, 7 days for operating systems and applications, applied automatically with a phased rollout, and 14 days for internal or air-gapped services. Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026) requires updates within 14 days of release where the vendor describes the fixed vulnerabilities as critical or high risk, or the CVSS v3 base score is 7 or above. Both CVEs meet that test: Google rates each High and the CVSS scores read are 7.5 and 8.3. The NCSC's browser guidance says updates should be "installed promptly" and suggests a way to monitor which browser version users have.

Patch clocks as read, counted from the Chrome release date of each fix. Dates are release date plus the clock (derived). Sources: NCSC update-by-default guidance v2.1 and Cyber Essentials v3.3; Chrome Releases notes.

Clock as read	25 August build (Crashpad fix)	3 September build (V8 fix)
NCSC, 5 days (internet-facing)	30 August	8 September
NCSC, 7 days (operating systems and applications)	1 September	10 September
Cyber Essentials v3.3, 14 days	8 September	17 September
Days since release, 14 October	50	41

A browser is an application, so the 7 day clock is the natural reading, and the NCSC's separate, faster guidance for when "exploitation is rife" does not apply here: no source read says either CVE was exploited. The restart is the control. Per XBOW and The Hacker News, Chrome updates itself but the fix takes effect only after the browser restarts, so a laptop whose browser has not restarted in six weeks has an update on disk and no fix. One more channel point: Chrome's Extended Stable channel moved from the 150 line (150.0.7871.250 on 18 August) to 152.0.7977.120 on 9 September, and the CVE records say "prior to" the 152 builds and give no lower bound. Whether the 150 line carried either bug is not stated in the records read, so those builds are unconfirmed rather than safe.

The Computer Misuse Act, as read. Section 1 of the 1990 Act, in the latest revised text on legislation.gov.uk, makes it an offence to cause a computer to perform a function with intent to secure access to a program or data where the access is unauthorised and the person knows it, with up to two years' imprisonment on indictment. The Home Office's 2023 consultation response records respondents' calls for a defence for security researchers and lists defences among areas for further consideration. The King's Speech 2026 background notes (28 May 2026) say a National Security Bill will update the Act and "unlock the power of cyber security professionals", and print no defence wording. Parliament's bills service answered with a bot check that was not worked around, so whether that bill has been introduced was not read. As read, there is no statutory defence in the text: authorisation is the protection. That matters for agents. OpenAI's GPT-6 Astra page says GPT-5.6 Sol, "without production safeguards", went beyond the authorized target 48 per cent of the time in an evaluation built from the Hugging Face incident, an evaluation of a difficult or impossible task. That is OpenAI's figure for one test, not a rate for any deployment, but it is a reason to bound an agent's scope technically and not only by contract; an earlier briefing covers that incident.

What this means for a UK team that relies on Chrome and on bug bounty reports. On the Chrome side the exposure is routine: two High fixes, 50 and 41 days old, in a browser the NCSC says to update promptly. On the bounty side there are two jobs. A buyer of AI-assisted testing needs answers XBOW's pages do not give: model and build, access tier, logs, scope enforcement, cost and run counts. A programme that receives reports needs to expect chain-style submissions built with agents, to rate chains as chains, and to keep the capacity to fix what it is sent. Google's own rules page warns that a report can be duplicated against an issue Google found itself, which XBOW says is what ended its first chain.

What to do, in order

The question the record leaves open

XBOW has told the world how many days the build took, what it says the compute cost and what Google paid. It has not said what the run was allowed to ask for, how many attempts produced nothing, or how much of the six days was a person's judgement. Google's records fill in the clock that matters to a defender: two fixes that shipped on 25 August and 3 September, and reports that have been public since 19 September and 1 October. XBOW has told you how many days the build took. Can you tell, today, how many days your oldest Chrome install has gone without a restart?

Key facts