XBOW collects Google's $250,000 full-chain Chrome bounty — "the second time in Google Chrome's history" — run on Sol 5.6
From the AI digest for 2026-10-13
What happened: a jason post relayed by Peter Steinberger (published Monday, October 13, 2026, around 3:11 PM ET): Oege de Moor's account of a team event — "For the second time in Google Chrome's history, Google awarded a $250,000 bounty for a full-chain exploit… to @XBOW," set against a challenge posed at an all-hands in Malta at the start of 2026; the thread's correction clause pins the run to sol 5.6 ("it was with sol 5.6 ._."). A full-chain exploit is a top-tier, end-to-end browser compromise; the bounty figure is USD as stated.
What's genuinely new: A debut — no storyline in the memory carries XBOW, AI-agent penetration testing, or a bug-bounty record; this opens the thread. It is the strongest receipt-grade AI-security datapoint in the window: a named agent, a named payer (Google), a specific product (Chrome), a specific dollar figure ($250,000), and a "second time in Chrome history" frame, with the model used (Sol 5.6) called out by the source of the relay. It also reads against the same-day sudo L7 board (§3) as the "judgment beyond writing correct code" thesis cashing out in security work. Caveats: single X-thread source; the "second time" framing is the author's own account, and no Chrome vulnerability-rewards page or Google acknowledgment appears in the window.
Watch: Google's own acknowledgment or patch notes for the exploit; identification of the first-ever full-chain bounty award; whether AI agents become a standing vulnerability-rewards category rather than a one-off headline; whether XBOW's result reproduces on other bounties or boards.