A public LLM wrote a Chrome exploit in six days – Your agents can too

01Six days, three bugs, a public model

Researchers at XBOW took OpenAI’s GPT‑5.6 Sol model—available to anyone—and used it as a reasoning partner to chain three then‑unknown Chrome vulnerabilities into a single attack. The result was a Chrome‑based exploit that, when a victim visited a malicious page, executed arbitrary Windows code without any user interaction beyond the page load.

Google confirmed all three bugs, patched them, and paid the researchers for the disclosure. The episode proved that a public LLM can translate raw vulnerability data into a weaponized exploit faster than a human‑only team could, simply by prompting the model to explore combinations of the findings.

02When an AI agent finds a critical OTP bypass, the hard part is deployment

During an authorized assessment, an autonomous pentesting agent discovered a serious authentication flaw in a major insurer’s production site. The flaw let the attacker choose where the one‑time passcode was delivered, effectively bypassing the second factor. The agent not only reported the issue but also demonstrated a live bypass on the production system.

The discovery itself was straightforward for the model, but turning the proof‑of‑concept into a reliable attack required careful handling of credentials, network routes, and timing—operations that most organizations automate for their own agents.

03Tiny models could become self‑replicating botnets

Anthropic warned that small AI models are only months away from being able to self‑replicate across IoT devices such as smart ovens and off‑brand Android TV boxes. Unlike classic malware, these “worm‑like” AI bots would have no single command‑and‑control server; each compromised device would carry its own inference engine and could launch new attacks from the edge.

The threat model is unsettling because the distributed nature makes conventional takedown strategies ineffective. An organization that lets agents run code on edge devices without strict containment could inadvertently become a launchpad for such a botnet.

04Why this matters for every AI‑enabled workflow

All three incidents share a single thread: an agent with the ability to generate or execute code, access credentials, or call external services can move from analysis to exploitation without human oversight. Whether the agent is a large LLM like GPT‑5.6, a newer Claude Code model, or a tiny “Fable‑class” model, the underlying risk is the same—automation of the full attack lifecycle.

When agents operate inside your CI/CD pipeline, your internal tooling, or on customer‑facing services, a single mis‑prompt or a missing guardrail can turn benign automation into a vector for credential theft, data exfiltration, or a self‑propagating worm.

05Concrete steps you can take today

Start by treating every agent as an untrusted component. Enforce a zero‑trust policy: only allow network destinations you explicitly list, keep API keys off the agent’s filesystem, and require human approval for any action that touches secrets.

Add static checks to your codebase. Geoffrey Huntley showed that a pre‑commit hook can scan diffs for direct calls to observability modules and reject the commit, forcing the agent to go through a vetted diagnostics library. This reduces drift and makes it easier to audit agent behavior.

• Lock each agent into its own sealed microVM with a single workspace folder.
• Define an egress allow‑list (e.g., api.anthropic.com, api.openai.com) and block all other outbound traffic.
• Store real API keys on the host; inject placeholders inside the sandbox and replace them at the egress point.
• Use checkpoints before risky operations and rewind on failure; keep a hash‑chained audit log of every action.
• Run malicious code samples in a dedicated lab sandbox that records all network activity.