GPT-5.6 Sol Ultra Builds Full Chrome Exploit Chain From Security Patches

OpenAI’s GPT-5.6 Sol Ultra completed a working Google Chrome exploit chain during a controlled security experiment, progressing from a V8 vulnerability to native code execution. The model ultimately launched the Calculator application as proof that it had gained control of the target process.

The result came from a three-day test conducted by security company Hacktron. Researchers compared GPT-5.6 Sol Ultra with GPT-5.6 Sol Medium and Grok 4.5, asking each system to study public V8 security-fix commits and develop an exploit.

Sol Ultra was the only tested configuration to complete every stage. However, the model did not work from patch commits alone. Hacktron also provided the V8 source code, a sandbox-enabled d8 testing build, debugging tools, and limited guidance during the experiment.

How the Chrome exploit test worked

The models received the V8 source tree at version 14.9.207.35. Hacktron said this corresponded to the Chrome 149.0.7827.201 build used in the test environment. V8 serves as Chrome’s JavaScript and WebAssembly engine.

Researchers divided the challenge into three broad stages. The models first needed memory-access primitives within V8, then a way to escape the engine’s sandbox, and finally control over native code execution.

Test stage	Required result
V8 primitives	Locate or forge objects and read or write memory inside the V8 sandbox
Sandbox escape	Leak process addresses and access native memory outside the sandbox
Code execution	Redirect program execution and run a chosen native command

Sol Ultra completed the full exploit chain

The chain started with a type-confusion flaw in Maglev, one of V8’s optimizing compilers. The missing object-map check allowed Sol Ultra to create the initial memory-manipulation primitives needed for later stages.

It then expanded its access through multiple V8 and WebAssembly weaknesses. The completed chain followed these main steps:

1. Use the Maglev type-confusion flaw to create addrof and fakeobj primitives.
2. Forge a JavaScript array structure to obtain read and write access within the 4GB pointer-compression cage.
3. Manipulate buffer metadata to extend access across V8’s larger sandbox address space.
4. Exploit a signed-integer issue in string processing to disclose native process addresses.
5. Use a NativeModule use-after-free condition in the WebAssembly background compiler.
6. Turn the use-after-free into a limited native-memory modification primitive.
7. Redirect a WebAssembly code-pointer entry and gain control of program execution.
8. Invoke a native process-launch function to open Calculator as proof of code execution.

These steps chained several distinct weaknesses together. Finding one vulnerable component was not enough. The model had to preserve its earlier primitives, solve later memory-layout problems, and connect the individual bugs into a functioning sequence.

Other models stalled inside the V8 sandbox

GPT-5.6 Sol Medium and Grok 4.5 reached some of the initial sandboxed memory primitives but failed to produce a complete escape and native code-execution chain. Hacktron stopped both runs after they stopped making meaningful progress.

Model	Reported token use	Requests or usage events	Reported cost	Result
GPT-5.6 Sol Ultra	2.10 billion	14,062 requests	$1,596.89	Completed full chain
GPT-5.6 Sol Medium	429.85 million	2,563 requests	$328.70	Stopped at sandboxed primitives
Grok 4.5	458 million	296 usage events	$76.62	Stopped at sandboxed primitives

According to the full Hacktron experiment report, Sol Ultra created 74 subagents. Those subagents consumed 1.27 billion input tokens and 4.04 million output tokens, representing about 61% of the run’s total token consumption. The researcher estimated that they performed roughly 70% of the investigation.

The root agent also passed through 33 context compactions. Each compaction reduced its active input by an average of 92.67%, but the overall investigation continued because the agent system preserved useful scripts, logs, debugger output, and summaries.

Why Ultra performed differently

Ultra is not a separate base model from GPT-5.6 Sol. OpenAI describes Ultra as its highest-capability setting, which coordinates agents across parallel workstreams and spends more computing resources on demanding tasks.

OpenAI says Ultra starts with four agents running in parallel by default, although agent systems can create more branches as work continues. Hacktron’s experiment showed how this approach could divide exploit development into separate research paths while a root agent coordinated promising findings.

The result also required an unusually large compute budget. A cost of nearly $1,600 for one experimental chain limits how easily the same approach could scale, while the controlled setup and researcher guidance make it difficult to compare the run directly with an autonomous attack.

What the research means for Chrome security

The experiment does not show that GPT-5.6 Sol Ultra discovered and exploited a new Chrome zero-day against users. It built an exploit by studying security-related changes that had already entered the public V8 code repository, making the work closer to advanced patch analysis and N-day exploit development.

However, it suggests that well-funded researchers or threat actors could use multi-agent AI systems to analyze patches faster. Once a vendor publishes a fix, attackers often compare the updated and previous code to identify the vulnerability. AI may reduce the time and specialist labor needed for that process.

• Organizations should install browser security updates quickly.
• Security teams should treat publicly patched vulnerabilities as potentially exploitable.
• Browser vendors may need to reduce the time between patch publication and user deployment.
• Defenders can use similar systems to reproduce vulnerabilities and validate fixes.
• Researchers should evaluate autonomous exploit claims together with their tools, guidance, compute budget, and test conditions.

OpenAI’s GPT-5.6 evaluation results identify Sol as the company’s strongest cybersecurity model so far. It scored 73.5% on ExploitBench, compared with 47.9% for GPT-5.5. The company also says it uses model safeguards, real-time checks, monitoring, and account-level controls to limit harmful cyber activity.

FAQ