Three days Pwn2Own Ireland turned fresh smartphones, AI services and a smart home into a testing ground for 98 zero-day vulnerabilities. The final score showed payments of $ 1.262 million, and the main winner was Ikotas Labs, which hacked Samsung, Google, OpenAI and Oracle products.
The finale identified the attack on Google Pixel 10. Ikotas Labs tied up a few mistakes and received $300,000 for a remote hack, the largest separate payment of the tournament. Zero Day Initiative confirmed that success brought the team 30 points and brought it to the first place in the Master of Pwn.
Total Ikotas Labs scored 42.5 points and earned $361,000. Earlier, the team had already hacked Codex through one argument injection error, attacked Samsung Galaxy S26 and compromised Oracle Autonomous AI Database. The second place took Xint with $240 000, the third got Team ZyGoat with $125 000.
Google Pixel 10 on the last day attacked three teams. Xint received $150 000 for remote hacking through an error that partially coincided with the already known problem. Another group earned $112,500 per chain of two errors. During the same day, the participants revealed 21 vulnerabilities and received $641,000, that is, more than half of all prize tournaments.
The Samsung Galaxy S26 has also become one of the most notable goals. In the first two days, the smartphone was hacked six times, although the device worked with the current firmware. In the finale, BunkyoWesterns carried out another remote attack, combining two errors. One turned out to be new, the second was already known, so the payment was reduced to $8250.
The competition covered seven categories, including mobile devices, AI infrastructure, programming tools, smart home, printers and medical gadgets. In total, 29 teams participated. iPhone 17 was also included in the list of targets with a reward of up to $ 300 000 for remote hacking, but no team registered for such an attempt.
The organizers use Pwn2Own to transfer the found errors to manufacturers before the publication of technical details. Vendors get 90 days to prepare corrections. Last year's Pwn2Own Ireland ended with 73 vulnerabilities and payments of $1.024 million, so the 2026 tournament has grown markedly in terms of the number of finds, and by the amount of rewards.
The finale identified the attack on Google Pixel 10. Ikotas Labs tied up a few mistakes and received $300,000 for a remote hack, the largest separate payment of the tournament. Zero Day Initiative confirmed that success brought the team 30 points and brought it to the first place in the Master of Pwn.
Total Ikotas Labs scored 42.5 points and earned $361,000. Earlier, the team had already hacked Codex through one argument injection error, attacked Samsung Galaxy S26 and compromised Oracle Autonomous AI Database. The second place took Xint with $240 000, the third got Team ZyGoat with $125 000.
Google Pixel 10 on the last day attacked three teams. Xint received $150 000 for remote hacking through an error that partially coincided with the already known problem. Another group earned $112,500 per chain of two errors. During the same day, the participants revealed 21 vulnerabilities and received $641,000, that is, more than half of all prize tournaments.
The Samsung Galaxy S26 has also become one of the most notable goals. In the first two days, the smartphone was hacked six times, although the device worked with the current firmware. In the finale, BunkyoWesterns carried out another remote attack, combining two errors. One turned out to be new, the second was already known, so the payment was reduced to $8250.
The competition covered seven categories, including mobile devices, AI infrastructure, programming tools, smart home, printers and medical gadgets. In total, 29 teams participated. iPhone 17 was also included in the list of targets with a reward of up to $ 300 000 for remote hacking, but no team registered for such an attempt.
The organizers use Pwn2Own to transfer the found errors to manufacturers before the publication of technical details. Vendors get 90 days to prepare corrections. Last year's Pwn2Own Ireland ended with 73 vulnerabilities and payments of $1.024 million, so the 2026 tournament has grown markedly in terms of the number of finds, and by the amount of rewards.
