Pwn2Own Ireland Paid Out for 32 Zero-Days, With AI Targets Front and Center
Day one of Pwn2Own Ireland 2026 drew 21 entries and $388,500 in bounties for 32 demonstrated zero-days. The AI infrastructure category paid twice: $40,000 to Taisic Yun for a LiteLLM reverse shell and $40,000 to Ikotas Labs for an argument-injection bug in OpenAI Codex. Researchers also hit the Samsung Galaxy S26 three times, and day two put another $780,000 in play.
On this page
AI infrastructure graduated to a main category
Day one of Pwn2Own Ireland 2026, held on 6 October, put 21 entries on stage across printers, smart home, wellness, mobile, and AI infrastructure, and ended with 32 demonstrated zero-days earning $388,500 in bounties. The category that matters most to this blog's readers is the new one: LiteLLM, the widely deployed proxy that sits in front of local and cloud models, and OpenAI's Codex coding agent were both formal targets, with bounties on the same scale as smartphone exploits.
That is a shift worth pausing on. Two years ago the contest's SoC targets were phones and routers; this year's schedule includes AI databases, coding agents, and local inference systems, which means the security research community has officially decided that model-serving infrastructure is attack surface worth championship-level effort. The results suggest they were right.
The LiteLLM and Codex wins
Taisic Yun of Xint took down LiteLLM with an improper input validation bug plus code injection, landing a reverse shell and earning $40,000 and four Master of Pwn points. The team Out of Bounds also reached a LiteLLM victory, but two of its four bugs collided with known issues, so the payout came to $15,000 and 3 points, a reminder that at Pwn2Own the novelty of each bug in the chain is what pays.
On the agent side, Ikotas Labs defeated OpenAI Codex with a single argument-injection bug, a clean success worth $40,000 and 4 points. An argument injection means the attacker controls how the model's own tools are invoked, which is the same failure class as the encrypted-injection attack demonstrated against Copilot CLI last week: not a model weakness, but a weakness in how much autonomy and file access agents are granted.
Collisions, day two, and what it means
The Samsung Galaxy S26 was hit three times on day one, but all three runs contained collisions with known or already-reported bugs, which is why the phone wins paid $31,250, $15,750, and $11,000 rather than full value. BleepingComputer's tally counted the Galaxy S26 as hacked twice for the headline number; the vendor-payout details live in ZDI's own ledger. Day two put 24 more attempts and roughly $780,000 cumulative in play, so the final totals will be materially higher by the close.
The takeaway for anyone running inference infrastructure is blunt. LiteLLM and Codex are two of the most common ways developers put models to work, and both fell on day one to bugs that paid the same as a flagship phone exploit. Patch cadence for your AI plumbing now deserves the same discipline as your routers, and the agents you let read files and call the network are, as of this month, officially tournament-grade targets.