https://ctxsec.comcontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.https://ctxsec.com/ai#xbow-chrome-fullchain-2026-10https://ctxsec.com/ai#xbow-chrome-fullchain-2026-10Tue, 13 Oct 2026 00:00:00 +0000confirmed (author's post)XBOW published that researchers plus AI agents (OpenAI GPT-5.6 Sol) built a three-bug Chrome→Windows full-chain in six days (Aug 2–7), winning Google's first $250,000 Chrome full-chain VRP under 2026 rules. Chain crossed V8 sandbox and renderer sandbox; bugs were reported, fixed, and never used against users. XBOW estimates ~$40k API compute. Caveat: this is a responsible-disclosure research write-up, not an in-the-wild campaign — keep Chrome updated and relaunch after updates.https://ctxsec.com/ai#agentic-bug-hunterhttps://ctxsec.com/ai#agentic-bug-hunterTue, 13 Oct 2026 00:00:00 +0000tool, communityBuilt around Claude Code: recon, known-CVE scanning and attack-surface ranking. Caveats: third-party community project, not audited by us; needs Claude Code or API access and won't run fully on local models without changes; only point it at targets you're authorized to test.https://ctxsec.com/ai#fuzzing-taskflowhttps://ctxsec.com/ai#fuzzing-taskflowSun, 11 Oct 2026 00:00:00 +0000toolOpen-source taskflows for the seclab-taskflow-agent framework that use an LLM to plan, build and triage fuzzing harnesses. Caveats: needs model API access and real compute; LLM-written harnesses still need human review, and crashes are not vulnerabilities until triaged.