WE BUILT A CHROME FULL-CHAIN EXPLOIT IN SIX DAYS. WATCH HOW

Summary from the TLDR InfoSec newsletter

A Chrome full chain used to take a team of four, 6 to 9 months. XBOW's AI agents [5] did it in six days with about $40,000 of model time. Three vulnerabilities, two sandbox escapes, code running on the host. Google confirmed it and paid the first $250,000 full-chain award under its 2026 rules. In this on-demand session, researcher Brendan Dolan-Gavitt walks through both attempts, the human-led chain that lost to a bug collision and the agent-led one that won.