AI Model Autonomously Builds Full Chrome Exploit, Raising Alarm for Defenders

Security researchers at Hacktron tested several cutting edge AI models, including GPT-5.6 Sol Medium, Sol Ultra, and Grok 4.5, on their ability to build a working exploit for a real Chrome vulnerability. Sol Ultra succeeded, working through the entire process largely on its own and ultimately gaining control of the target with only limited human nudges. The researchers describe this as a significant leap compared to previous models tested only months earlier.

The exercise used a known Chrome vulnerability in the V8 JavaScript engine, where a security fix had already been published. Sol Ultra was given the source code and asked to find and exploit the flaw, which involved a flaw in how the browser's Maglev compiler handled array iteration checks. The model used numerous sub-agents and made heavy use of a technique called context compaction to manage its reasoning efficiently, ultimately building a working exploit chain. The two other models tested, Grok 4.5 and Sol Medium, got partway through the process but became stuck and did not succeed.

While this research was conducted for defensive and benchmarking purposes, it signals that the barrier between a known software bug and a working attack tool is shrinking rapidly for anyone with access to advanced AI models and significant computing power. This has implications for how quickly attackers could weaponise disclosed vulnerabilities in widely used software like Chrome.

Key Takeaway: Businesses should prioritise applying browser and software security updates as quickly as possible, since the time between a vulnerability being disclosed and it being actively exploited is likely shrinking due to AI-assisted exploit development.