Pwn2Own Ireland: 98 zero-days found, $1,262,000 in prizes awarded

Wide range of targets, from phones to AI coding agents

According to TrendAI, researchers found flaws across several categories: mobile phones, smart home devices, wellness products, printers, messaging, AI infrastructure and AI coding agents. The company said the event celebrated the efforts of the global security research community.

Ikotas Labs, Inc. won the title Master of Pwn and $300,000. The team chained multiple issues together to exploit the Google Pixel 10 at the very end of the three-day competition. TrendAI said Ikotas Labs is the first Japanese team to claim the Master of Pwn title.

Xint placed second and earned $150,000 for a remote exploit of the Google Pixel 10 through a single bug collision. Interrupt Labs earned $5,000 after it took over a Lexmark CX532adwe printer and played DOOM on its screen.

From stage demonstration to vendor patch

Dustin Childs, Head of Threat Awareness at TrendAI's Zero Day Initiative, said the vulnerabilities found at the event are sent to vendors so they can patch them quickly. Visibility into the flaws also helps protect TrendAI customers through virtual patching, he said.

Childs also stressed what defenders take away from the contest. In his words, "Every exploit chain demonstrated on stage teaches us something new about how modern systems break." He said those lessons feed into the training of TrendAI's own research capability, so it can discover, validate and remediate the next flaw faster. He added that as AI tools and infrastructure become central to business functions, staying ahead of vulnerabilities will be "as critical as ever."

TrendAI argues that the familiar devices on stage are the point. Watching a researcher chain several flaws to take over a consumer phone makes visible a process that usually happens out of sight. According to the company, it is the same process, and often the same class of flaw, that applies to enterprise systems behind ecommerce, banking, critical infrastructure and healthcare.

Patching concerns and customer protection

TrendAI said its research has shown that vendors are increasingly neglecting to patch software vulnerabilities that are disclosed to them. The company claims that through its ZDI coordinated disclosure process, TrendAI Vision One customers are protected an average of 115 days ahead of the rest of the industry.

Caroline Kiel, CEO of PingUs, was quoted in the announcement. She said it was encouraging to see vendors onsite encouraging researchers to poke holes in their products, and that Pwn2Own turns fresh vulnerability research into immediate protection.

What it means

The results show that consumer and enterprise-relevant technology, including newer AI infrastructure and coding agents, remains a target for exploit research. According to TrendAI, disclosures made through the Zero Day Initiative at Pwn2Own and year-round give vendors the chance to fix flaws before cybercriminals exploit them, which benefits organizations and end users of the affected software and hardware.

The next Pwn2Own competition is expected in early 2027. More details are available on the Zero Day Initiative blog.