OpenAI’s GPT-5.6 Sol Ultra model independently constructed a complete, working exploit chain against a recent version of Google Chrome, escalating from a memory corruption bug to arbitrary native code execution without step-by-step human direction.
Documented by hacktron, the test used Chrome 149.0.7827.201 and its underlying V8 engine at version 14.9.207.35, with the model given the source tree, relevant security-fix commits, and a sandbox-enabled d8 build to work against.
Mohan structured the challenge around three escalating capability tiers mirrored on the ExploitBench framework: building target primitives such as addrof and fakeobj, achieving generic read and write access outside the V8 sandbox, and finally gaining full program-counter control for code execution.
GPT-5.6 Sol Ultra Builds Full Chrome Exploit Chain
While competing models, including Grok 4.5 and a smaller Sol Medium variant, stalled at the intermediate sandboxed read-and-write stage, Sol Ultra was the only model to advance to a functioning exploit capable of launching an arbitrary native command.
What distinguished this run was the model’s use of a sprawling subagent architecture. The root agent consumed 819.6 million input tokens and 2.02 million output tokens directly, but it delegated the bulk of the investigative work to 74 subagents, which together processed 1.27 billion input tokens and 4.04 million output tokens.
Roughly 70 percent of total reasoning and exploit development occurred within these subagent branches, with the root model increasingly serving as a planner and validator rather than a direct investigator.
The exploit chain itself moved through nine distinct technical stages. It began with a Maglev type-confusion bug in Chrome’s JIT compiler, which the model used to forge a fake JSArray header and build a four-gigabyte read-and-write primitive inside V8’s pointer-compression cage.
From there, the model expanded that access into a full one-terabyte sandbox primitive by manipulating resizable ArrayBuffer metadata, then leaked native process addresses via a signed-integer flaw in V8’s string traversal logic, and used WebRTC objects for heap grooming.
A use-after-free vulnerability in V8’s background WebAssembly compiler allowed the model to hijack a stale compiler pointer, which it then converted into a native OR primitive and used to redirect Chrome’s WebAssembly Code Pointer table to attacker-controlled memory, ultimately achieving code execution that launched a calculator process as proof.
Mohan noted that the model’s ability to withstand repeated context compaction was critical to sustaining a multi-day investigation.
The root agent underwent 33 context compactions, each reducing active token load by an average of 92.67 percent, yet the investigation never meaningfully derailed because subagents preserved detailed logs, proof scripts, and debugger output that the root could reconstruct as needed.
The hacktron also found that Sol Ultra showed markedly better judgment than earlier models at abandoning unproductive leads rather than getting stuck in local minima, a persistent weakness in prior exploit-development benchmarks.
OpenAI has separately confirmed that GPT-5.6 Sol is its strongest cybersecurity-oriented model to date, scoring 73.5 percent on ExploitBench compared to 47.9 percent for GPT-5.5, though the company maintains that the model is trained to refuse prohibited offensive cyber assistance and remains in a restricted preview limited to vetted partners.
The disclosure adds to growing evidence that frontier AI systems are closing the gap between vulnerability discovery and full weaponization, intensifying pressure on browser vendors and AI labs to coordinate on patch timelines before such capabilities become broadly accessible.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs
