An AI Reportedly Built a Working Chrome Exploit by Itself - Here's What That Claim Actually Means

I want to slow down on this one before the headline runs away from the facts, because the actual story is more interesting - and more useful - than "AI can now hack Chrome." An independent security research firm says OpenAI's GPT-5.6 Sol Ultra model built a complete, working exploit chain against Google Chrome with minimal human guidance. That's genuinely significant. But OpenAI's own official safety testing, on the same model, reportedly found the opposite result under its own evaluation conditions. Both things are true at once, and understanding why is a better use of your next five minutes than either the hype version or the dismissal. The direct answer: Independent researchers at Hacktron report that GPT-5.6 Sol Ultra, given Chrome's source code and public security patch commits, built a working exploit chain reaching full code execution in a sandboxed test environment. OpenAI's own published safety evaluations, using different test conditions against live targets, state the model did not autonomously produce a functional full exploit chain and did not cross the company's internal "Cyber Critical" risk threshold. The model remains restricted to a small group of vetted partners rather than being publicly available. Quick Facts Detail Info Model GPT-5.6 Sol Ultra (OpenAI) Third-party test conducted by Hacktron, an AI security research firm Target Google Chrome 149.0.7827.201 / V8 engine 14.9.207.35 Test conditions Model given source code access and public patch commits; sandboxed test build Reported result (Hacktron) Full exploit chain reaching native code execution OpenAI's own evaluation result Did not autonomously produce a functional full-chain exploit; did not cross "Cyber Critical" threshold ExploitBench score 73.5% (GPT-5.6 Sol), up from 47.9% (GPT-5.5) Public availability Restricted preview, limited to vetted partners only Comparable prior test Hacktron ran a similar benchmark against Claude Opus roughly three months earlier What Hacktron's Test Actually Showed Hacktron gave three frontier AI models — GPT-5.6 Sol Medium, Sol Ultra, and xAI's Grok 4.5 — a specific, structured research task: analyze the source code changes in a set of Chrome security patches and build a working exploit chain from that starting point, tested inside a sandboxed, non-production build of Chrome's V8 JavaScript engine. This follows a standard three-stage approach used throughout browser security research generally — establishing memory manipulation primitives inside the browser's security sandbox, escaping that sandbox, and ultimately achieving code execution outside it. According to Hacktron's published results, Sol Ultra completed this chain successfully, reaching full native code execution in the test environment, and did so with meaningfully better efficiency than earlier models — the researchers specifically noted it was better at abandoning unproductive approaches rather than getting stuck repeating the same failed attempts, a common weakness in earlier exploit-development testing. Sol Medium, notably, did get stuck in exactly that kind of repetitive dead end partway through. This wasn't Hacktron's first such experiment — they ran a comparable benchmark against an Anthropic Claude model roughly three months earlier with less complete results, making this a direct before-and-after comparison of how fast this specific capability has moved. It's worth being precise about what this setup actually represents. The model wasn't hunting for an unknown vulnerability in a live, current version of Chrome running in the wild. It was given the patches — meaning the underlying bugs were already known and already fixed in later Chrome versions — and asked to reverse-engineer a working exploit for the pre-patch version from that information. That technique, called patch diffing, is a well-established part of human security research too. It's a meaningfully different, more constrained task than autonomously discovering a brand-new, unpatched vulnerability in a production system with no hints provided. What OpenAI's Own Testing Found — And Why It Disagrees This is the part most coverage buries, and it's the actual insight here. OpenAI's own published safety evaluations, conducted under its own testing conditions against Chromium and Firefox, state that GPT-5.6 Sol identified real bugs and exploitation components but "did not autonomously produce a functional full-chain exploit under the conditions tested," and that the model was unable to carry out autonomous, end-to-end attacks against hardened targets. Based on those results, OpenAI concluded the model did not cross its internal "Cyber Critical" capability threshold — the bar the company uses to decide whether a model requires additional restriction beyond its standard safeguards. The gap between these two results isn't necessarily a contradiction so much as a difference in what was tested. Hacktron's benchmark handed the model source code, relevant patch commits, and a sandboxed