Pwn2Own Ireland 2026 breaks phones and AI infrastructure
Start here
Pwn2Own Ireland 2026 kicked off in Cork, receiving over 60 entries in total, with a record-high number of phone targets. In the AI infrastructure category, LiteLLM, Chroma, Dynamo, and Oracle Autonomous AI Database were listed as attack targets, with per-project prizes ranging from $20,000 to $40,000; OpenAI Codex appeared in the Coding Agent category with a $40,000 prize. On the first day there were 21 entries covering categories including phones, printers, smart home, and AI infrastructure: Viettel Cyber Security broke the Samsung Galaxy S26 with 4 vulnerabilities (3 already known to the vendor), and Interrupt Labs also broke the model with 4 vulnerabilities (3 collisions); Ikotas Labs broke OpenAI Codex with a single parameter injection vulnerability, earning $40,000. On October 8, three research teams remotely broke fully patched Google Pixel 10 devices, with the three wins totaling $562,500 in prizes; Ikotas Labs took the highest prize of the event at $300,000 and 30 points by chaining multiple issues, and earned Master of Pwn, Xint's single-bug collision earned $150,000, and Dimitrios Valsamaras et al.'s two-bug chain earned $112,500.
Generated by AI from reports · Updated 4 days ago
Latest developments
Progress timeline
- The Hacker NewsThree teams remotely compromise fully patched Google Pixel 10 at Pwn2Own
On October 8 at Pwn2Own in Ireland, three research teams remotely compromised a fully patched Google Pixel 10, with combined prize money of $562,500 across the three victories. Ikotas Labs took the highest prize of the event, $300,000 and 30 points, with a chained exploit of multiple issues, and also earned Master of Pwn; Xint's single-bug collision earned $150,000, and a two-bug chain by Dimitrios Valsamaras and others earned $112,500. At least two of the attempts used bugs known before the event; ZDI has not yet disclosed the specific exploitation methods for the three, nor has it listed remediation measures.
- Zero Day InitiativePwn2Own Ireland 2026 day one results: targets including Samsung Galaxy S26, LiteLLM, and OpenAI Codex compromised
Pwn2Own Ireland 2026 day one had 21 entries in total, covering categories such as mobile phones, printers, smart home, and AI infrastructure. Viettel Cyber Security compromised the Samsung Galaxy S26 with 4 vulnerabilities (3 known to the vendor), and Interrupt Labs also compromised that model with 4 vulnerabilities (3 collisions); Ikotas Labs compromised OpenAI Codex with a single parameter injection vulnerability, earning $40,000; Xint achieved a reverse shell on LiteLLM using an input validation flaw plus code injection, earning $40,000; VinSOC compromised the Oracle Autonomous AI Database with 5 vulnerabilities, earning $40,000. Multiple targets, including Brother, Lexmark, Google Pixel 10, and Chroma, were unsuccessful due to timeout.
- Zero Day InitiativeFull Pwn2Own Ireland 2026 schedule announced: LiteLLM, OpenAI Codex, Oracle Autonomous AI Database, and other AI infrastructure are targets
Pwn2Own Ireland 2026 kicked off in Cork, receiving over 60 entries in total, with a record number of mobile phone targets. In the AI infrastructure category, LiteLLM, Chroma, Dynamo, and Oracle Autonomous AI Database were listed as attack targets, with individual prize money ranging from $20,000 to $40,000; OpenAI Codex appeared in the Coding Agent category, with a prize of $40,000. The Google Pixel 10 - Remote category had the highest single prize, at $300,000 and 30 Master of Pwn points.
Related discussion
- Older than 72 hours · Not included in the 72-hour figures
- 公众号DoonsecPwn2Own 2026 day one results are out: 32 0-days compromise products including Samsung S26 and OpenAI Codex(opens the original post in a new tab)
- Redditr/netsecPwn2Own Ireland 2026 Day 1: 32 Zero-Days, $388,500, Samsung Galaxy S26 Hacked 3 Times(opens the original post in a new tab)
Attention trend
New sources per day
- Oct 7New1 sources (1 outlets,0 accounts)
- Oct 8New2 sources (1 outlets,1 accounts)
- Oct 9New1 sources (1 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)