Real Alpha

TBPN · 5 min instead of 2 h 52 m · Oct 13, 2026

One researcher plus AI agents found a Chrome full-chain exploit in 6 days

Oege de Moor

Founder & CEO, XBOW

Former Oxford professor who sold Semmle to GitHub, then created GitHub's Copilot and Advanced Security products.

  • John CooganHost · Co-host, TBPN

    Co-founded Soylent and Lucy; OpenAI bought his show TBPN in April 2026.

  • Jordi HaysHost · Co-host, TBPN

    Founded Branded Native; co-founded fintech Capital, which Rho bought.

About this segment

XBOW's CEO says one researcher with an agent swarm on a public model found a one-click Chrome takeover in six days for about $40,000. Agency teams reportedly need around six months for this kind of work.

From “Muse Wonder, Anjney Sizes Up, Neal Stephenson Joins, Social Reckoning Review, Eli Manning Live”, Oct 13, 2026. Watch the full episode

“What that means is that you just point your web browser at one malicious website, and the attacker will own your entire Windows PC.”
Oege de Moorat 2:00:37 · TBPN2:00:37

Takeaways

  1. The exploit took over a full Windows PC from a single malicious web page visit
  2. It took six days and about $40,000 of compute on a publicly released model
  3. Google paid its maximum bounty of $250,000 for the bug
Watch 5:04 from 2:00:08

In this episode

Full episode

  1. 2:00:08One researcher plus AI agents found a Chrome full-chain exploit in 6 days5:04

  2. 54:13How pooled compute lets startups and public users share GPU capacity4:41Up next
  3. 2:19:56Why micro machines are an unserved manufacturing space2:44