In October 2026, researchers built a $250,000 Chrome full-chain exploit in six days using a public AI model. Defenders now face a new triage question: was this exploit AI-built? Check the 12 signals below against your suspect sample and get a heuristic likelihood band — heavily labeled as signals, never proof.
Read this first: no checklist can prove AI authorship. Skilled humans can mimic every signal below, and AI output can be edited to hide them. This tool produces investigative leads, not evidence. See "What this does NOT do" below.
Direct answer: AI-generated malware means attack code substantially produced by AI models. In October 2026, XBOW disclosed building a $250,000 Chrome full-chain exploit in six days using OpenAI's public GPT-5.6 Sol model. No signal proves AI authorship — but code uniformity, iteration speed, and commit patterns are heuristic signals defenders can score. This page is a checklist, not proof.
Tick every signal you observe in the suspect sample. Signals are grouped in three families.
Yes — as a research demonstration. On October 13, 2026, XBOW disclosed that its team built a Chrome full-chain exploit in six days using AI agents running OpenAI's publicly available GPT-5.6 Sol model, at about $40,000 in compute. Google confirmed the three bugs, fixed them, and paid its top $250,000 full-chain reward. Human researchers directed the agents throughout.
No. There is no reliable test that proves AI authorship of code. The signals on this page — code-style uniformity, iteration speed, commit patterns — are heuristics: they raise or lower suspicion, but a skilled human can mimic them and AI output can be edited to hide them. Treat any score as an investigative lead, never as evidence.
Three families: (1) code-style uniformity — identical naming, comments, and error handling with no personal quirks or 'scar tissue'; (2) iteration speed — complex chains assembled in days with no visible dead ends; (3) commit patterns — monolithic commits, generic messages, no review back-and-forth. This checker's 12 signals cover all three.
No — capability is what matters, not authorship. The XBOW case is the warning: a full Chrome chain that once took elite researchers months was compressed into six days. Defenders should triage on what the code does and how fast such capability can now be rebuilt, not on who or what wrote it.
Honest scope: incident facts are drawn from the linked XBOW and Hacker News sources. The 12 signals are heuristic indicators compiled for defender triage, not a validated detection method. No score on this page constitutes proof of authorship.