XBOW's AI found a full-chain Chrome vulnerability affecting 1 billion users in just 6 days
Oct 13, 2026 with Oege De Moor
Key Points
- XBOW's AI discovered a full-chain Chrome vulnerability affecting 1 billion users in six days for $40,000, vastly faster than the six-month timeline intelligence agencies typically require.
- The exploit allows attackers to seize complete control of Windows PCs through malicious websites with no user download required; Google paid its maximum $250,000 bounty and notified the FBI.
- XBOW used publicly available GPT models to demonstrate that offensive security research at nation-state capability levels is now accessible to well-funded private teams, narrowing the window before broad proliferation.
Summary
Read full transcript →XBOW's AI found a full-chain Chrome vulnerability affecting roughly a billion users in six days, at a cost of $40,000 using an off-the-shelf GPT model. Google acknowledged the bug and paid its maximum bounty of $250,000. The FBI was also notified.
The vulnerability is severe in the most practical sense: a user visits a malicious website and an attacker gains full control of their Windows PC, including email, bank accounts, passwords, and keystrokes. No download required. De Moor says intelligence agencies typically need a team of people and around six months to find this class of Chrome bug. XBOW did it in six days, with one researcher working alongside an agent swarm.
“You just point your web browser at one malicious website, and the attacker will own your entire Windows PC — your email, bank account, passwords, keystrokes. This vulnerability affects a billion users. Google acknowledged the problem, paid their maximum bounty. But what's really interesting is that it only took six days, and the compute cost was just $40,000 using an off-the-shelf GPT model.”
What this signals for the threat landscape
The $40,000 compute cost matters because it resets expectations about who can run this kind of offensive research. De Moor notes that open-source models are currently three to four months behind frontier models on cyber capabilities, which implies the window before nation-state-grade tooling is broadly accessible is narrowing, not widening. The Chrome discovery used a publicly available GPT model, not a restricted one, specifically to make that point.
The product
The Chrome research is a preview of a new product line targeting desktop applications and firmware. XBOW already has a released product, used by hundreds of enterprises, that autonomously tests web applications the way a skilled penetration tester would, without causing damage. De Moor's argument for automation is simple: there are not enough human security experts to keep pace, even with human-in-the-loop approaches.
The $250,000 bounty versus $40,000 cost makes the unit economics look clean for now, but De Moor's actual commercial pitch is the enterprise scanning product, not bug bounties.
Every deal, every interview. 5 minutes.
TBPN Digest delivers summaries of the latest fundraises, interviews and tech news from TBPN, every weekday.