Xbow engineer and GPT-5.6 collaborated on Chrome exploit chain, Forbes reports

Forbes reported on October 13, 2026, that Xbow engineer Brendan Dolan-Gavitt worked with OpenAI’s Sol model, which Forbes identified as GPT-5.6, on a chain of three previously unpatched Google Chrome vulnerabilities. Forbes placed the work at Black Hat in Las Vegas in August and reported that Google confirmed an exploit and the maximum $250,000 reward about a month later. Forbes

How Dolan-Gavitt worked with Sol

Forbes said Dolan-Gavitt asked Sol to help devise ways to breach Chrome’s security and collaborated with the model; the account says he did not write the exploit himself. The reported work involved a three-vulnerability chain. Forbes reported that Google confirmed one exploit, not three separate findings.

What the award and token spend add up to

Forbes reported $40,000 in token costs for the model-assisted work. That is 16% of the $250,000 maximum reward. Subtracting the token spend from the reward gives a $210,000 difference before labor and other costs.

Xbow representative Jared Snyder said the company’s Native Team earned the first Chrome Full Chain Exploit Bonus of 2026 and only the second in history. Snyder credited Dolan-Gavitt and security team lead Nico Waisman in his LinkedIn post.

Other submissions and the model’s name

Xbow said two additional AI-generated exploits were awaiting Google review when Forbes published its report on October 13.

Forbes identified the model used in the Chrome work as OpenAI Sol/GPT-5.6. In a separate August 10 announcement, OpenAI described GPT-5.6-Cyber, a specialized model built on GPT-5.6 Sol, and discussed separate V8 research.