Pwn2Own Ireland 2026 wrapped up on 8 October with 98 demonstrated zero-days and about $1.26 million in payouts — and, for the first time in the competition's history, artificial intelligence infrastructure among the targets.
AI systems were on the board alongside phones, printers and smart-home devices. Researchers took multiple shots at Oracle's Autonomous AI Database and at Chroma, with the Oracle target falling first to an exploit chain from OtterSec and later to a separate chain from Platform Security. The Zero Day Initiative's schedule listed AI infrastructure, including LiteLLM, among the week's categories.
Mobile phones remained the richest prizes. Samsung's Galaxy S26 was compromised repeatedly across the three days — six successful attacks by the close of play, according to trackers of the results — while all three attempts on Google's Pixel 10 landed. Ikotas Labs took the Master of Pwn title after chaining several issues together to exploit the Pixel 10, finishing with 42.5 points and $361,000. Printers from Brother, Canon and Lexmark, and smart-home gear including the Philips Hue Bridge Pro and Home Assistant Green, also went down.
Pwn2Own operates on a 90-day coordinated disclosure window, meaning vendors get roughly three months to fix the demonstrated flaws before technical details are released. The arrival of AI infrastructure targets reflects a broader shift: as enterprises rush to deploy AI databases, orchestration layers and model gateways, those systems are becoming attractive targets rather than experimental side projects.
