XBOW: the $250K Chrome full-chain bounty for an AI pentesting agent

status: open, opened 2026-10-13, last moved 2026-10-13. AI google agents safety

• 2026-10-13: Oege de Moor reports Google awarded a $250,000 bounty for a full-chain Chrome exploit to AI agent XBOW — "for the second time in Google Chrome's history" — run with Sol 5.6 per jason's correction, against a challenge set at a Malta all-hands at the start of 2026 (via steipete, ~3:11 PM ET — https://x.com/steipete/status/2110104694286897561). Debut thread — no XBOW or AI-agent bug-bounty storyline existed; the strongest receipt-grade AI-security datapoint in the record to date. Single X-thread source; no Google acknowledgment in the window. Watch: Google's own bounty/patch confirmation, identity of the first full-chain award, whether AI agents become a standing vulnerability-rewards category.