THE SAME JOB USED TO TAKE AN ELITE TEAM 6–9 MONTHS: ‘DEFEND ACCORDINGLY’

XBOW researcher Brendan Dolan-Gavitt wrote that before large language models, a Chrome full chain would take a team of four around six to nine months to produce. XBOW's first submission took two months, and the awarded chain took six days, built with about $40,000 in compute using a public OpenAI model.

Coverage of the disclosure urged defenders to plan accordingly, noting the economics have changed: a capability once associated with nation-state teams and months of specialist work can now be reached by a small group in a week. Google paid a $250,000 bounty, patched the three bugs in the chain, and XBOW stressed the vulnerabilities had not been exploited against users.