Oege de Moor

For the second time in Google Chrome’s history, Google awarded a $250,000 bounty for a full-chain exploit… to @XBOW. Here’s the full story:

At an all-hands at the start of 2026 in Malta, I set the team a crazy challenge. A full-chain exploit of Chrome by the annual Black Hat cybersecurity conference in August.

I believed there were few better tests of whether @XBOW could move beyond web applications to desktop software, servers and devices.

Chrome is one of the most hardened pieces of software on the planet, used by more than half the world’s population.

A full-chain exploit lets an attacker take total control of a machine, where they can read every email, password and bank login the user types. You don’t need to download anything or click a phishing link. Visiting the wrong site is enough.

So @moyix, Andres Luksenberg, Baul Lee, and Willem Pinckaers took on the challenge along with a fifth teammate: OpenAI's GPT-5.6 Sol.

They built a chain they thought would win, but Google told us they already knew one of the bugs.

We were already in Las Vegas for Black Hat and DEF CON, and the team didn’t want to go home without the win.

So Brendan and the agents built a new exploit in just 6 days.

We submitted it to Google and waited.

The news came through that we'd done what should’ve been impossible. A full-chain bounty of $250,000, the first awarded under Google’s 2026 rules.

It took just 6 days and $40,000 of compute to construct an exploit that affects a billion users of Chrome on Windows. An intelligence-agency veteran told me his team used to spend 6 months on this kind of vulnerability.

My takeaway: the cost of finding truly critical vulnerabilities is collapsing, for attackers and defenders alike. Restricting powerful models is not the answer; GPT-5.6 Sol is already public.

But defenders have one advantage attackers never will: they can test their own code first.

Assume your software is exploitable. Whoever is hunting your bugs has the same building blocks we did.

This is cause for urgency but not panic.

XBOW is now developing an autonomous product for testing compiled software (desktop applications, servers, embedded devices), and partnering with the world’s top organizations to design that product.

If you’d like to be one of them, get in touch.

P.S. Restart Chrome whenever the Update button appears!

Which AI model gives you the most web exploits for your money?

We tested Claude Mythos 5.1 and OpenAI's GPT-6 lineup with @Xbow on 65 vulnerable open-source web apps (RCE, XSS, SSRF, SQLi and more).

Here is what the data says: 🧵

Is OpenAI’s new GPT-6 Cyber better than GPT-6.1 Sol at hacking web apps?

We tested it with @Xbow on 65 vulnerable open-source apps (RCE, XSS, SSRF, SQLi and more).

Here’s what we found: 🧵

For 21 years I was an Oxford professor giving tutorials: solving technical problems with one or two students at a time. Students and tutor push each other to be their best.

I love this form of teaching! There’s nothing like it - learning by letting creative sparks fly.

Students sit alone or in pairs with their tutor for an hour to discuss ideas, challenge arguments, and debate complex problems. You learn by asking questions and following where your curiosity takes you.

It’s an ancient tradition, held in beautiful old buildings where the walls themselves have absorbed centuries of learning.

I was very lucky that many of my students were much too smart for standard exercises with known solutions, and so we’d tackle open research problems instead.

In fact, some of my best research came from running out of exercises and working through real research problems with my students. Looking at my Google scholar page today, about half of my most-cited papers came about this way!

I particularly remember discussing aspect-oriented programming with a student of mine, Damien Sereni.

It introduced a new programming language feature called ‘cflow’ that sounded nice but ran terribly slowly. That afternoon, Damien came up with a way to make it much faster, and we published the work together at a major international conference.

That kind of discovery is only possible in an environment that allows people to explore their curiosity.

We keep the same tutorial spirit of research-by-debate at @Xbow . Challenging each other’s ideas, asking questions, and solving them in the simplest way possible, reasoning from first principles.

Great ideas start with questions and curiosity. Inventions emerge in debate.

The Origin Story of Github Copilot:

In 2020, @GitHub had just acquired my startup, Semmle, and the CEO, @natfriedman, gave me free rein to find our next product.

At the time, I had a bee in my bonnet: GitHub had more data than anyone else about developer behavior, but it wasn’t using that data to build new products.

I started exploring how to change that.

In June 2020, I got early access to GPT-3 and saw its potential to write code, especially if trained on the code on GitHub. It was the obvious project to work on.

It could generate a little code on its own, but almost always got it wrong. So I gave the model a set of 50 programming puzzles, the kind I used to set at Oxford entrance interviews.

I asked the model to solve each puzzle 1,000 times, using automated tests to check it. Given enough attempts, it got almost all of them right. That's when I knew it would be able to code.

I assembled a small initial team of ~10 people to work on what became GitHub Copilot. The first two people who joined were co-founders of the project: @thewunderalbert and @alexgraveley

Fortunately key people at OpenAI shared our vision, and it was the perfect partnership at the perfect time with @sama, @gdb, @ilyasut, @DarioAmodei and Sam McCandlish (months before Anthropic was born!), @npew and several others.

OpenAI trained the model behind it, Codex, and we built the product around it. It ran inside VS Code and suggested lines of code and functions as you typed.

The VS Code team, led by @ErichGamma, moved mountains to give us exactly what we needed. The Azure AI team of Misha Bilenko also helped make it scalable.

When we launched the technical preview in June 2021, it hit 1.2 million users in 12 months. It was an instant hit with developers and helped write billions of lines of code.

It also left me with an uncomfortable thought. The models had learned to code from public source code, and public source code has a lot of vulnerabilities in it.

It was easier than ever to write vulnerable code, and developers were shipping it faster than ever.

But, I knew that if AI could write the code, it could find the holes in it too. It was imperative that defenders got it before attackers did.

In 2023, I left GitHub to build @Xbow to do exactly that. Since then, we've already helped our customers find and fix more than 14,000 zero-days and the work has only just begun.

The same team that started the AI coding revolution is now leading the charge on AI security.