Researchers demonstrated 98 unique zero-day vulnerabilities at Pwn2Own Ireland, earning a total of $1,262,000 in prizes across three days of competition in Cork, TrendAI has announced. Twenty-nine teams made 61 attempts, and the categories on offer ranged from the familiar — mobile phones, printers, smart home devices — to a pair that would have been unusual a few years ago: AI infrastructure and AI coding agents. That shift is the most telling thing about this year’s contest.
Contests of this kind are worth reading for two things: the volume of zero-day vulnerabilities they surface, and the direction in which the target list is moving. The volume this year was large — 98 unique flaws, up from 73 a year earlier — and the direction was unmistakably toward AI. For defenders, the second signal matters more than the first, because it indicates where the next wave of flaws is likely to come from.
The headline result went to a single product. Three teams broke the Google Pixel 10 on the final day for a combined $562,500, and Ikotas Labs’ chain of multiple bugs earned the $300,000 top award and the Master of Pwn title — the first Japanese team to take it. Ikotas also broke a Samsung Galaxy S26, OpenAI’s Codex and Oracle’s Autonomous AI Database during the event, finishing with $361,000 and 42.5 Master of Pwn points. Xint placed second, and Team ZyGoat third. In lighter news, Interrupt Labs took over a Lexmark printer and ran DOOM on its screen.
AI moves onto the target list
Pwn2Own is not a new contest, but its target list keeps moving. ZDI introduced AI as a category in 2025 and expanded it into several categories for 2026. At Ireland, “AI infrastructure” covered targets such as the Oracle Autonomous AI Database, LiteLLM, Dynamo and Chroma, while a separate “coding agent” category covered Anthropic’s Claude Code and OpenAI’s Codex. The rules require a successful attempt to bypass the product’s authentication where it has one, or to escape the agent’s sandbox and permissions.
The results suggest researchers were ready. According to an independent breakdown of ZDI’s scoreboard, AI infrastructure drew 13 attempts, 10 of them successful, for $187,750 — about 15% of the total prize money — and produced 23 of the 98 zero-days. The coding-agent category drew a single attempt, against Codex, and it succeeded for $40,000. Every AI target that drew an entry was broken at least once. The Oracle database fell five times out of five, LiteLLM twice out of two, Dynamo once, and Chroma twice out of five. That four AI infrastructure products fell ten times in thirteen attempts — a 77% success rate — is higher than the contest’s overall 51 successes in 61 attempts. That is a small sample, but it suggests AI targets are currently softer than the devices the contest has tested for years, which is worth watching but not yet a settled conclusion.
The prize structure tells the same story. Mobile phones and smart-home devices still dominate the cash, because they are mass-market and the bounties are high; AI infrastructure took a smaller share of the money but a larger share of the flaws. That mismatch — many zero-day vulnerabilities for comparatively modest prizes — suggests AI targets are currently easier to break than they are valuable to break, which is itself worth noting.
The trust-boundary problem
What makes these results more than a curiosity is that the failures cluster around the same cause. TrendAI’s own researchers have named it the “trust boundary problem”: modern AI products — coding agents, inference proxies, vector stores — do not run in isolation. They call external tools, protocols and services, and they tend to inherit the trust assumptions of whatever they touch without independently validating the input that arrives at those interfaces.
The disclosed details fit that description. OpenAI’s Codex fell to what ZDI describes as a single argument-injection bug. A LiteLLM exploit paired improper input validation with code injection to obtain a reverse shell. One Oracle chain ran seven bugs, ending in a use-after-free and a type confusion. In each case the AI product did not break in isolation; it broke at the seam where it met something it trusted. That is the pattern behind most of the zero-day vulnerabilities in the AI categories.
That matters because those seams multiply as teams wire agents into more enterprise systems — every new integration is a potential boundary where inherited trust can be exploited. The finding has a practical edge for anyone deploying AI agents. A coding agent that reads a repository, a gateway that routes requests to models, or a vector store that indexes documents all sit between a user and a model, and each inherits assumptions about the other. Hardening the model is not enough if the boundary around it is porous; the enterprise-grade question is whether those interfaces validate what reaches them.
There is a second, quieter signal. TrendAI reported that most contestants used AI agents themselves while developing their attacks, for reconnaissance, bug discovery and exploit work. The same tools that expand an enterprise’s attack surface are also accelerating the search for weaknesses in it.
The disclosure machine
The value of Pwn2Own rests on what happens after the stage. Under ZDI’s coordinated disclosure process, the vulnerabilities go to the vendors, who get a fix window — report as 90 days in some coverage and 120 in others — to patch before ZDI publishes details. TrendAI says virtual patching protects its Vision One customers an average of 115 days ahead of the rest of the industry, by blocking exploitation of known flaws at the network layer before a vendor patch arrives.
Readers should treat that as a vendor claim rather than a measured outcome, because TrendAI is not a neutral observer here. Its Zero Day Initiative runs the contest, and TrendAI — Trend Micro’s enterprise business unit — both sponsors the event and issues the announcement. The research is genuine and the disclosures are real, but the framing serves a company that sells the defence the contest demonstrates the need for. The same applies to the survey-adjacent claim in the release that vendors are “increasingly neglecting” to patch disclosed flaws: plausible, consistent with industry complaints, but TrendAI’s own.
What to watch
Three things will show whether the AI category is a trend or a novelty. First, whether the AI share of disclosures grows at the next contest, expected in early 2027, or stays a small slice of a base dominated by phones and smart-home devices. Second, whether the specific failure mode — trust boundaries between AI products and the tools they call — persists as vendors harden those interfaces, or shifts to new classes of flaw. Third, whether the disclosures translate into timely patches: the contest’s value depends on vendors fixing what researchers find, and the release itself concedes that patching discipline is uneven.
The disclosure model is the part that gives the contest its value beyond spectacle. Flaws found on stage are not left to the public; they go to the vendor under an embargo, and only later are the details published. That structure converts a competitive event into a supply of fixes, which is why the number of zero-day vulnerabilities matters less than how many are patch in time.
For security teams, the practical takeaway is an inventory question. The products that fell at Pwn2Own — an LLM gateway, a vector store, an inference server, a managed AI database, a coding agent — are ordinary network services with authentication in front of them, and they are increasingly stood up by teams without central oversight. Knowing which of them run inside an organisation is the precondition for defending them.
What the announcement does and doesn’t establish
It establishes the prize total, the number of unique zero-days, the winners and the category structure, all of which independent coverage corroborates. It does not establish that AI flaws are yet a dominant share of the risk — the AI categories are new and the base is small — nor does it publish the individual bug details, which remain under disclosure, or the vendors’ patch status.
The honest summary is that Pwn2Own delivered another large haul of zero-days, and the contest continues to do what it exists to do: surface flaws before criminals exploit them and hand them to vendors to fix. The change worth noting is where researchers are finding the flaws. AI infrastructure and coding agents are now regular targets, and the pattern of their failures — at the boundary where they trust something else — is a preview of the attack surface that will scale alongside enterprise AI adoption.
That is a more useful takeaway than the prize figure, and it comes with a caveat: a company selling the remedy runs the event. If the AI share grows, the next contest will show whether the trust-boundary problem is a phase or a fixture. Either way, the zero-day vulnerabilities demonstrated this year will be measured by how quickly the vendors behind them ship fixes.
Editor’s Note: This article draws on the TrendAI release, ZDI’s published rules and results, and independent security-press coverage. The prize totals, zero-day count and winners are corroborated by independent coverage; the AI-category shares are derived from ZDI’s scoreboard by a third party. The 115-day protection and virtual-patching figures are TrendAI’s own claims. TrendAI’s Zero Day Initiative organises the contest and TrendAI issues the announcement. No interview was conducted.