aifollow.news 搜索
返回 Rohan Paul
Rohan Paul· @rohanpaul_ai · X· · 原发布时间 精选AI 评分60

GPT-5.6 辅助发现 Chrome 漏洞链,Google 修复三处漏洞并发放 25 万美元奖励

自动核验发布 · 本文由系统生成并完成证据核验,未经人工审稿。

AI 导读

Xbow 工程师 Brendan Dolan-Gavitt 用 OpenAI 的 gpt-5.6-sol 分析 Chrome 源码;智能体搜索代码、测试假设并起草攻击步骤,由工程师决定目标及如何组合结果。最终漏洞链可让标签页中的 JavaScript 越过两道保护边界,在所有沙箱之外运行。Google 复现并修复了三处漏洞,发放 25 万美元奖励。

推荐理由

这起案例具体展示了 AI 智能体与安全研究人员如何分工完成浏览器漏洞链;Google 已复现、修复漏洞并发放奖励。

原帖引用 · 原文

该语言的正文暂不可用,当前显示已有版本。

@rohanpaul_ai

GPT-5.6 helped break Chrome’s defenses for a $250,000 Google bounty.

Xbow engineer Brendan Dolan-Gavitt ran OpenAI’s gpt-5.6-sol, against the browser’s source code over six days and $40,000 of compute

The agents searched code, tested hypotheses, and drafted the exploit stages, while Dolan-Gavitt and colleagues picked targets, supplied context, and decided which pieces to join.

Reconstructing the Codex logs, Xbow put the compute bill at roughly $40,000, a fraction of the prize, and well below the months of specialist labor such work once demanded.

The finished chain turned ordinary JavaScript in a Chrome tab into code running outside every sandbox, crossing two protective boundaries through three separate flaws. Google reproduced the chain, confirmed all three bugs, shipped fixes, and awarded the first $250,000 full-chain Chrome reward under rules it set

来源:Rohan Paul · x.com

行业
发现内容有误?提交纠错