No, the first working full chain was entirely invalidated and they fixed all the bugs involved in that chain. So we had to start from scratch at the beginning of August and both found the vulns and built the exploit in 6 days, for $40k. We actually found ~11 vulns throughout those 6 days; we submitted three as a full chain, the middle stage collided, and we submitted one of the backups as a replacement for that stage.
Nice! So with what you guys have already built, the 4 of you working full-time can crank out 1 working Chrome full-chain a week for under $50K in token spend?
TBH this specific chain described in the post was just one person + agents (but greatly helped by being able to reference exploit techniques from the other chain we built collaboratively)!
Off-topic*: Can I even visit untrusted websites anymore? (Was there ever a time when I could do that?) Firefox's security is probably far worse than Chrome's, and escaping the browser sandbox now seems accessible to way too many people.
* Kind of on-topic given the last sentence of the article...
This exploit is mitigated by disabling JIT, which you can do in edge. Chrome only has a "disable v8 optimizations", which doesn't entirely disable JIT, but might still mitigate this bug. Not sure about all the other chrome forks.
12 comments
[ 0.28 ms ] story [ 5.9 ms ] thread1. CEO announces goal in January.
2. Team “took 2 months” on first working full chain.
3. In August, they swap out 1 bug in the chain with a new one, weaponize in 6 days. Weaponization of 1 bug costs $40K in 5.6 sol token spend.
Is that it?
* Kind of on-topic given the last sentence of the article...