OpenAI model used to build Chrome full-chain exploit in six days

By Splitfeed EditorialLast updated Oct 14, 2026, 11:40 UTC

In October 2026, researchers disclosed that they had used a publicly available OpenAI model to construct a full-chain exploit targeting Google Chrome, completing the project in six days at a total cost of $250,000. The model, described as off-the-shelf and requiring no special access or licensing, identified a zero-day vulnerability in Chrome as part of the process. The work was reported by Forbes and The Hacker News on October 13 and 14, 2026, respectively.

The significance here lies in what the numbers suggest about accessibility. A full-chain exploit, meaning one that strings together multiple vulnerabilities to achieve reliable code execution, has historically demanded months of work from highly specialized teams. Six days and $250,000, while not trivial, places that capability within reach of a much wider range of actors, including well-funded criminal groups, nation-state proxies, and private intelligence contractors. The central dispute is whether off-the-shelf AI models have genuinely crossed a threshold in offensive capability, or whether the $250,000 cost and the need for researchers skilled enough to direct the model still represent a meaningful barrier.

No reactions from the Pro-AI, Anti-AI, or Middle Ground camps had been published at the time of reporting. Pro-AI voices would typically argue that the same capability that builds exploits also accelerates defensive research, patch development, and vulnerability discovery by defenders, framing this as a dual-use tool whose net effect depends on who adopts it fastest. Anti-AI voices would be expected to point to this as concrete evidence that capability releases outpace safety evaluation, and that putting exploit-grade research tools into general availability without restriction is a policy failure. Middle Ground commentators would likely call for structured access controls and coordinated disclosure norms tailored specifically to AI-assisted offensive security research, rather than broad restrictions on model availability.

The most consequential near-term development to watch is whether Google confirms the zero-day and issues a patch, which would establish a public record of the vulnerability's severity, and whether OpenAI or regulators respond with any updated guidance on model use in offensive security contexts.