News about security vulnerabilities

XBOW, an autonomous offensive security company, said its platform earned a $250,000 Chrome Vulnerability Reward Program award from Google for a full-chain Windows exploit, the first such reward under Google's 2026 rules and the first granted to an autonomous security platform. Working with OpenAI's GPT-5.6 Sol models, XBOW's AI agents and one researcher chained three previously unknown bugs over six days, at an estimated $40,000 of compute, to run code outside Chrome's sandbox. Google reproduced, confirmed and fixed the bugs, and XBOW says they were never used against users. Before the fixes, the flaw sat in the path of an estimated one billion Chrome users on Windows, and XBOW will use the award to fund work securing NGOs.