GPT-5.6 Sol Ultra AI Creates Full Chrome Exploit Chain from Patches

Key Takeaways

• OpenAI’s GPT-5.6 Sol Ultra AI model successfully generated a full, functional exploit chain for Google Chrome.
• The AI achieved this by analyzing public security patch commits for Chrome’s V8 JavaScript engine.
• This breakthrough demonstrates AI’s potential to automate complex exploit development, accelerating the “patch gap” challenge for defenders.
• Security teams must prioritize rapid patching of N-day vulnerabilities, as AI-driven exploitation could emerge faster than ever.

OpenAI’s advanced GPT-5.6 Sol Ultra model has independently developed a complete, operational exploit chain targeting Google Chrome. This significant achievement was accomplished using only publicly available security patch information as its foundation.

AI Models Tackle Offensive Security Challenge

Researchers at Hacktron initiated a real-world offensive security experiment, tasking three cutting-edge AI models—GPT-5.6 Sol Medium, Sol Ultra, and Grok 4.5—with a challenging objective. Their mission was to analyze security fix commits for V8, Chrome’s JavaScript engine, and subsequently construct a full exploit chain from the ground up.

The AI models were provided with access to the V8 source tree, specifically version 14.9.207.35, which corresponds to Chrome 149.0.7827.201. Additionally, they had a sandboxed d8 build at their disposal for testing purposes.

The exploitation process was structured into three standard stages common in browser security research:

• Target Primitives: The initial goal was to establish “addrof,” “fakeobj,” and arbitrary read/write capabilities within the V8 sandbox.
• Sandbox Escape: This stage involved leaking critical addresses (binary, libc, and stack) to enable native memory read/write operations outside the sandbox.
• Code Execution: The final objective was to gain control over the program counter and execute an arbitrary command.

Among the tested models, only Sol Ultra successfully completed the entire exploit chain, demonstrating code execution by launching a calculator application. Grok 4.5 and Sol Medium, while achieving initial memory leaks, became trapped in repetitive dead ends and failed to progress further.

Sol Ultra’s Exploit Chain Breakdown

Sol Ultra’s exploit sequence commenced with identifying a Maglev type-confusion vulnerability, specifically a missing map check within V8’s inlined array iterator. This bug was leveraged to establish “addrof” and “fakeobj” primitives. From this initial foothold, the AI systematically escalated its privileges:

• It crafted a fabricated JSArray, enabling 4GB cage read/write access.
• This access was then expanded to encompass full 1TB V8 sandbox access through the corruption of DataView metadata.
• Native process addresses were subsequently leaked by exploiting a signed-integer bug found in string handling (String::VisitFlat).
• A NativeModule use-after-free vulnerability in Wasm’s background compiler was exploited to achieve a controlled native OR primitive.
• The WebAssembly Code Pointer table was then pivoted to redirect program execution.
• The final stage involved hijacking a posix_spawnp call, leading to the execution of the Calculator application as definitive proof of code execution.

Hacktron observed that Sol Ultra utilized an impressive 2.1 billion tokens to process 14,062 requests, incurring an estimated cost of $1,597. The process involved the creation of 74 sub-agents, which were responsible for approximately 70% of the investigative work.

Remarkably, the root agent endured 33 context compactions, losing over 92% of its active context each time. Despite these significant context reductions, it consistently maintained sight of the overarching exploitation strategy.

Implications for Cybersecurity

This development transcends mere academic interest; it signals a profound shift in the landscape of exploit development. Historically, exploit creation has been a highly specialized skill, accessible only to a limited number of experts. The emergence of AI models like Sol Ultra suggests that this process could evolve into a scalable, compute-driven endeavor.

If well-resourced adversaries can dedicate substantial computational power to AI models to weaponize patches faster than defenders can deploy them, the critical “patch gap” that security teams rely on for mitigation could shrink dramatically. This scenario poses an urgent challenge to current cybersecurity strategies.

What You Should Do

• Accelerate Patching Cycles: Prioritize the immediate application of security patches, especially for N-day vulnerabilities. The window for exploitation is likely to decrease significantly.
• Monitor AI/ML Threat Landscape: Stay informed about advancements in AI-driven offensive capabilities and integrate this intelligence into your threat modeling.
• Enhance Vulnerability Management: Strengthen your vulnerability management programs to identify and remediate weaknesses proactively, reducing the attack surface available for AI exploitation.
• Invest in Automated Defenses: Explore and implement automated security solutions that can detect and respond to novel attack patterns generated by AI more rapidly than manual processes.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.