---
title: AI | ctxsec
url: https://ctxsec.com/ai
---

# AI

AI security and AI for security: vuln-hunting agents and tools, with honest caveats.

confirmed (author's post)

2026-10-13

### XBOW: AI-assisted Chrome full-chain (6 days) earns Google's first $250k 2026 VRP award

XBOW published that researchers plus AI agents (OpenAI GPT-5.6 Sol) built a three-bug Chrome→Windows full-chain in six days (Aug 2–7), winning Google's first $250,000 Chrome full-chain VRP under 2026 rules. Chain crossed V8 sandbox and renderer sandbox; bugs were reported, fixed, and never used against users. XBOW estimates ~$40k API compute. Caveat: this is a responsible-disclosure research write-up, not an in-the-wild campaign — keep Chrome updated and relaunch after updates.

Sources: [XBOW blog](https://xbow.com/blog/xbow-built-a-chrome-full-chain-exploit) · [XBOW Labs technical post](https://xbow.com/labs/research/zero-to-calc-in-six-days-inside-xbow-chrome-full-chain)

tool, community

2026-10-13

### Agentic Bug Hunter (community bug-bounty toolkit)

Built around Claude Code: recon, known-CVE scanning and attack-surface ranking. Caveats: third-party community project, not audited by us; needs Claude Code or API access and won't run fully on local models without changes; only point it at targets you're authorized to test.

Sources: [GitHub](https://github.com/awarexone/Agentic-Bug-Hunter)

tool

2026-10-11

### GitHub Security Lab Fuzzing Taskflow

Open-source taskflows for the seclab-taskflow-agent framework that use an LLM to plan, build and triage fuzzing harnesses. Caveats: needs model API access and real compute; LLM-written harnesses still need human review, and crashes are not vulnerabilities until triaged.

Sources: [seclab-taskflows-fuzzing](https://github.com/GitHubSecurityLab/seclab-taskflows-fuzzing) · [seclab-taskflow-agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent)