Two experiments put a price on building a full Chrome exploit chain with AI: about $40,000 of compute for a $250,000 bounty, and $1,597 in a controlled lab. They aren't directly comparable, and the differences are the interesting part.
XBOW, the offensive security firm, directed AI agents using OpenAI's public GPT-5.6 Sol model to build a complete exploitation chain against Chrome between August 2 and 7, 2026. According to The Hacker News and RuntimeWire, Google awarded $250,000, the first maximum reward for a full chain under the program rules introduced in April 2026. XBOW estimates about $40,000 in AI compute charges for the campaign.
The chain links three flaws: one in the V8 JavaScript engine, one in the animated WebP decoder, and one in Crashpad (the crash handler), to escape the renderer sandbox and run code on the system. The Hacker News assigns the V8 and Crashpad flaws the identifiers CVE-2026-85045 and CVE-2026-78952, and says the result affected around a billion Chrome users on Windows before the patch.
The agents searched Chrome's source code, tested hypotheses, built proofs of concept, and drafted exploits. The human researchers chose the targets, provided context, validated results, and decided where to integrate the pieces. RuntimeWire stresses that it was AI-assisted, human-directed work, not autonomous. Brendan Dolan-Gavitt of XBOW summarized it to The Hacker News this way: before LLMs, a full Chrome chain took a team of four 6 to 9 months; the award-winning one took six days.
Hacktron, another firm, published a benchmark run in July 2026 with GPT-5.6 Sol Ultra, which Mohan Pedhapati (co-founder and CTO) shared again on September 29. The model completed a working chain from a V8 flaw to native code execution (as proof, it opened Calculator) at a reported compute cost of $1,596.89.
But the context is different: according to the sources, Hacktron did not provide just the patch commits; it also supplied the V8 source code, a sandboxed d8 build, debugging tools, and limited guidance. RuntimeWire emphasizes that it was a controlled lab and that repeatability and the total real-world cost are not demonstrated.
They aren't comparable one to one: XBOW's cost includes exploring a real target and discarding dead ends; Hacktron's is a bounded experiment with aids. Together they show a range: the cost of one attempt can be thousands of dollars, and that of a serious campaign tens of thousands, versus the person-months of before. What's defensible is the trend, not a single price.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel