Security researchers uncovered 98 zero-day vulnerabilities and collected more than $1.26 million in rewards during Pwn2Own Ireland 2026, demonstrating how much undiscovered security risk remains inside some of the world’s most widely used technologies. Over three days of competition in Cork, Ireland, participants successfully compromised flagship smartphones, artificial intelligence platforms, smart home devices and enterprise infrastructure, often combining multiple vulnerabilities to bypass security protections. The results provide a rare demonstration of how sophisticated attacks can succeed against fully updated products, challenging the assumption that installing the latest security patches necessarily eliminates exploitable weaknesses.
The competition concluded with $1,262,000 awarded for 98 zero-day vulnerabilities, surpassing the previous year’s results of 73 vulnerabilities and $1,024,750 in prizes. Twenty-nine research teams participated across seven technology categories, with successful demonstrations involving products from Samsung, Google, Oracle and several connected-device manufacturers. Although the event rewards researchers for compromising commercial technologies, its purpose is defensive: vulnerabilities are privately disclosed to manufacturers, allowing them to develop security updates before technical exploitation details become public. The scale of this year’s discoveries illustrates both the growing sophistication of vulnerability research and the persistent difficulty of securing increasingly complex software ecosystems.
Smartphones Remain Valuable Targets for Security Researchers
Mobile devices attracted some of the competition’s most significant attacks, particularly the Samsung Galaxy S26 and Google Pixel 10. Despite running current software, both smartphones were successfully compromised multiple times, with researchers demonstrating that modern mobile security architectures can still contain weaknesses capable of supporting sophisticated exploit chains. These results are especially relevant because smartphones now serve as central authentication devices, storing sensitive communications, financial information, personal identities and access credentials for enterprise applications. Their compromise can therefore have consequences extending well beyond the device itself, potentially exposing accounts and services that depend on the smartphone as a trusted endpoint.
Samsung’s Galaxy S26 was compromised repeatedly throughout the competition, beginning with successful demonstrations by Interrupt Labs, Ikotas Labs and Nguyen Thanh Dat of Viettel Cyber Security on the opening day. Additional attacks followed from KAIST Hacking Lab, PetoWorks and researchers associated with CENSUS Labs, before another successful demonstration occurred on the final day. Some of the vulnerabilities involved were already known to the manufacturer, highlighting the distinction between discovering a previously unknown flaw and successfully exploiting a weakness that has not yet been fully remediated. The results also demonstrate why vulnerability chains deserve particular attention: individual weaknesses that appear manageable in isolation can become considerably more dangerous when combined to bypass multiple layers of protection.
Google’s Pixel 10 became another major focus during the final day, when three independent research teams successfully compromised the device through remote attacks. Ikotas Labs delivered the most financially significant demonstration, earning $300,000 after chaining multiple vulnerabilities to compromise Google’s flagship smartphone. The result represented the competition’s largest individual award and contributed substantially to the team’s overall victory. While the successful demonstrations confirm that researchers identified exploitable weaknesses, they do not establish that the same attacks are being used against ordinary smartphone owners. The technical details remain subject to coordinated disclosure, and competition conditions should not be confused with evidence of widespread malicious exploitation.
The absence of an attack against Apple’s iPhone 17 is also worth interpreting carefully. Although the device was eligible for a remote exploitation award worth up to $300,000, no participant registered an attempt. That outcome does not demonstrate that the iPhone is more secure than competing devices, because competition results depend on which researchers participate, which vulnerabilities they have discovered and which targets they choose to pursue. Security comparisons based solely on successful demonstrations can therefore be misleading, particularly when the number of attempted attacks differs substantially between products.
AI Infrastructure Emerges as a New Security Battleground
One of the most revealing developments at Pwn2Own Ireland 2026 was the inclusion of artificial intelligence infrastructure and AI coding applications among the competition’s targets. As organizations integrate generative AI into software development, data processing and enterprise automation, the supporting platforms are becoming increasingly valuable from a security perspective. AI systems frequently interact with sensitive repositories, databases, external services and internal business applications, creating complex trust relationships that attackers may attempt to exploit. Vulnerabilities in these environments can potentially compromise more than an isolated application, particularly when automated systems possess permissions to access information or execute actions across connected services.
Researchers demonstrated successful attacks against OpenAI Codex and Oracle Autonomous AI Database, illustrating that AI-related platforms face many of the same fundamental security challenges as conventional enterprise software. During the opening day, researchers exploited an argument-injection weakness affecting Codex, while other participants demonstrated multi-vulnerability exploit chains against Oracle’s database platform. Additional AI infrastructure targets were compromised as the competition progressed, reinforcing the importance of evaluating the entire technological environment surrounding AI systems rather than concentrating exclusively on model behavior.
The significance of these demonstrations extends beyond the individual products involved. Organizations increasingly deploy AI agents capable of reading documents, executing code, querying databases and interacting with external applications, often through integrations designed to improve productivity. Every additional capability introduces permissions, interfaces and dependencies that must be secured. Traditional software vulnerabilities can become particularly consequential when they affect components operating with elevated privileges or access to sensitive enterprise resources. The emergence of AI platforms as prominent Pwn2Own targets therefore reflects a broader shift in cybersecurity research toward the infrastructure enabling autonomous computing.
These findings also challenge the idea that securing AI primarily involves preventing harmful responses or malicious prompts. Model-level protections remain important, but they cannot replace conventional application security, access controls, dependency management and vulnerability testing. An AI platform can enforce sophisticated restrictions on generated content while still exposing exploitable weaknesses in its surrounding services. The competition demonstrates why organizations adopting AI technologies must evaluate their underlying software architecture with the same rigor applied to databases, operating systems and internet-facing applications.
Connected Devices Expand the Attack Surface
Smart home products, printers and connected healthcare devices also featured prominently in the competition, revealing how vulnerabilities extend across technologies that are increasingly embedded in everyday environments. Researchers successfully targeted devices including the Sonos Era 300 smart speaker, Home Assistant Green and Philips Hue Bridge Pro, alongside commercial printing equipment and connected wellness products. These devices often combine embedded operating systems, network services, cloud integrations and mobile applications, creating multiple opportunities for security weaknesses to emerge. Unlike conventional computers, many connected products remain operational for years with limited user interaction, making long-term software maintenance and reliable update mechanisms particularly important.
Some demonstrations involved complex exploit chains containing several vulnerabilities, while others were executed in remarkably short periods once the researchers had completed their preparation. A successful attack against the Sonos Era 300, for example, was demonstrated in under a minute during the second day. That execution time should not be mistaken for the amount of effort required to discover the underlying weaknesses, since reliable exploitation can involve extensive reverse engineering, debugging and testing before a competition begins. Nevertheless, the demonstration illustrates how quickly a prepared exploit can operate once an attacker reaches a vulnerable component.
Connected devices present a particularly difficult security challenge because they frequently operate within trusted local networks while receiving less scrutiny than servers or employee workstations. A compromised smart home controller or printer may provide opportunities to interact with other networked systems, depending on its configuration and available permissions. In enterprise environments, similar concerns apply to building-management systems, network-connected peripherals and specialized operational equipment. As these technologies become more interconnected, security teams must increasingly account for devices that were historically treated as peripheral infrastructure rather than potential entry points.
The inclusion of wellness healthcare devices further demonstrates how security considerations are expanding into products that process potentially sensitive personal information. Connected health technologies may store measurements, synchronize information with cloud services or communicate with mobile applications, introducing privacy and security requirements beyond those associated with ordinary consumer electronics. The competition’s results do not establish that attackers are actively targeting these particular products, but they reinforce the importance of independent testing before vulnerabilities become accessible to malicious actors.
Ikotas Labs Takes the Top Prize as Vulnerability Research Accelerates
Ikotas Labs emerged as the overall winner of Pwn2Own Ireland 2026, securing the Master of Pwn title with 42.5 points and $361,000 in total rewards. The team demonstrated successful attacks against the Samsung Galaxy S26, OpenAI Codex and Oracle Autonomous AI Database before earning the competition’s largest individual prize for its Pixel 10 exploit chain. Its performance illustrates the breadth of expertise increasingly required in advanced security research, where successful teams must understand different operating systems, application architectures and exploitation techniques rather than specializing exclusively in one technology category.
Xint finished second with $240,000 and 27.5 points, while Team ZyGoat placed third with $125,000 and an equivalent points total. The overall results reflected substantial activity throughout the competition, with researchers collecting $388,500 on the opening day, $232,500 on the second and $641,000 during the final day. These figures demonstrate the financial incentives available through legitimate vulnerability research, particularly for discoveries affecting high-value targets. They also illustrate how coordinated disclosure programs can provide researchers with a structured alternative to selling exploit capabilities through less transparent channels.
The competition is organized by Trend Micro’s Zero Day Initiative, which requires participating products to run current firmware and researchers to demonstrate successful exploitation under established rules. After a vulnerability is confirmed, technical information is shared with the affected manufacturer, which generally receives 90 days to develop a security update before public disclosure. This process is intended to balance the benefits of transparency with the practical need to prevent detailed exploit information from becoming available before vendors have an opportunity to respond. It also gives manufacturers access to research that may identify weaknesses overlooked during internal testing.
The increase from 73 vulnerabilities in 2025 to 98 in 2026 represents a substantial expansion in the number of flaws demonstrated during the Ireland competition. However, that growth should not automatically be interpreted as evidence that software has become proportionally less secure. The number of discovered vulnerabilities depends on participating researchers, eligible targets, competition rules and the resources invested in finding exploitable weaknesses. A larger total may reflect increased research activity, more complex targets or broader participation rather than a direct deterioration in security quality. What the results clearly establish is that significant vulnerabilities continue to exist across a wide range of fully updated technologies.
What Pwn2Own Reveals About Modern Cybersecurity
The most important lesson from Pwn2Own Ireland 2026 is not that a particular smartphone, database or connected device failed a security test. It is that modern computing environments contain layers of complexity that cannot be completely evaluated through conventional development and testing processes alone. Software products depend on extensive libraries, operating system components, network protocols and external integrations, each introducing potential weaknesses that may interact in unexpected ways. Even when individual components have been thoroughly tested, vulnerabilities can emerge from the relationships between them, creating exploit chains that cross multiple security boundaries.
For manufacturers, the competition provides an opportunity to discover and correct serious weaknesses before they are publicly documented or exploited in real-world attacks. For organizations deploying the affected technologies, it reinforces the importance of maintaining security updates, monitoring vendor advisories and understanding which devices and services are exposed to potential attackers. It also demonstrates why vulnerability management must consider operational context rather than treating every flaw as equally dangerous. An exploitable weakness in an internet-facing authentication service, for example, may require a different response priority from a vulnerability affecting a device isolated within a restricted network.
The growing presence of AI infrastructure and connected healthcare technologies also suggests that vulnerability research will continue expanding into areas previously associated with specialized software or emerging markets. As these systems become integrated into business operations and personal environments, their security failures may have increasingly significant consequences. Independent research programs will therefore remain essential not only for discovering vulnerabilities but also for testing assumptions about how effectively modern security architectures withstand determined attackers.
Pwn2Own Ireland 2026 ultimately demonstrates that security is not a permanent state achieved by installing the latest software version. It is a continuous process of identifying weaknesses, understanding their potential consequences and correcting them before adversaries can take advantage. The $1.26 million awarded to researchers represents a substantial investment in that process, while the 98 demonstrated zero-days provide manufacturers with concrete opportunities to strengthen their products.
The competition’s real achievement is not the number of devices successfully compromised, but the number of serious vulnerabilities discovered under controlled conditions before they could become the foundation of real-world cyberattacks.