GPT-5.6 协助 Xbow 破解 Chrome 沙箱获 Google 25 万美元赏金

AI 导读

Xbow 工程师 Brendan Dolan-Gavitt 用 OpenAI 的 gpt-5.6-sol 对 Chrome 源码运行六天、花费约 $40,000 算力，智能体负责搜索代码、验证假设并起草漏洞利用环节，人类负责选目标和串联。

推荐理由

原文给出了漏洞链的完整成本与人力对比，读者可据此评估 AI 智能体在安全研究中的实际经济价值。

正文 · 原文

GPT-5.6 helped break Chrome’s defenses for a $250,000 Google bounty.

Xbow engineer Brendan Dolan-Gavitt ran OpenAI’s gpt-5.6-sol, against the browser’s source code over six days and $40,000 of compute

The agents searched code, tested hypotheses, and drafted the exploit stages, while Dolan-Gavitt and colleagues picked targets, supplied context, and decided which pieces to join.

Reconstructing the Codex logs, Xbow put the compute bill at roughly $40,000, a fraction of the prize, and well below the months of specialist labor such work once demanded.

The finished chain turned ordinary JavaScript in a Chrome tab into code running outside every sandbox, crossing two protective boundaries through three separate flaws.

Google reproduced the chain, confirmed all three bugs, shipped fixes, and awarded the first $250,000 full-chain Chrome reward under rules it set