Ikotas Labs won the Master of Pwn title at Pwn2Own Ireland 2026 after chaining multiple flaws to exploit the Google Pixel 10 for a $300,000 award on the contest's final day, the Zero Day Initiative said Thursday. Two other teams also took over the Pixel 10, and researchers compromised Oracle's Autonomous AI Database, three printers and two smart home hubs.

What Happened

ZDI's Dustin Childs wrote that 17 attempts were scheduled for day three, with about $1.33 million in prize money available, and the results post was updated through the day.

The Pixel 10 dominated the payouts. Ikotas Labs' exploit earned $300,000 and 30 Master of Pwn points, enough to take the overall title. Tim Becker and Yves Bieri of Xint exploited the phone remotely with a single bug that turned out to be a collision, meaning it was already known, for $150,000 and 15 points. Dimitrios Valsamaras and Ken Gannon of Mobile Hacking Lab, working with Tenia Valsamara of CENSUS Labs, used the AI tool Djini.ai in a remote two-bug chain, one a collision and one a zero-day, for $112,500. BunkyoWesterns hacked the Samsung Galaxy S26 remotely with a two-bug chain for $8,250.

RelatedNew curl Release Fixes 24 Flaws, Including a High-Severity Bug Reported With Anthropic’s Claude

In the AI infrastructure category, Oracle Autonomous AI Database was exploited twice: by OtterSec, whose four-bug chain included three collisions, for $6,250, and by Platform Security for $6,000.

FuzzingLabs earned $20,000 for exploiting a Brother MFC-L8970CDW printer with a single zero-day. Summoning Team hacked a Canon imageFORCE 1643F with four unique bugs and anonymous researchers took a Lexmark CX532adwe with two, each for $5,000. The Philips Hue Bridge Pro fell to Summoning Team and to @_McCaulay, both with collisions, for $5,000 each. Home Assistant Green was exploited by Ben Koo and Evangelos Daravigkas of Team DDOS for $4,500, and Team MAMMOTH closed the contest with a chain of six zero-days against the same device for $7,500.

The only failure ZDI listed was White Noise Club, which could not get its exploit of the Garmin Index BPM blood pressure monitor working in the time allowed.

Why It Matters

Phones remain the contest's most valuable targets, and the Pixel 10 results show why: three separate teams found ways in on one day. The Xint and CENSUS Labs entries both depended at least partly on collisions, which suggests multiple research groups are converging on the same Android weaknesses.

The CENSUS Labs and Mobile Hacking Lab team's use of Djini.ai adds to signs that AI tools are becoming part of offensive vulnerability research, a theme that ran through this year's event alongside the new AI infrastructure category.

Event Totals

ZDI's post did not give totals for the day or the contest. Adding up the awards ZDI listed for day three gives about $635,000, by The Primary Wire's count. Combined with the $388,500 paid on day one and $232,500 on day two, as we reported earlier, the event paid out roughly $1.26 million, compared with $1,024,750 at last year's Ireland edition.

Earlier in the week, researchers compromised AI tools including OpenAI's Codex, LiteLLM, Nvidia's Dynamo and the Chroma vector database, and the Galaxy S26 was hacked several times. No team registered to attack Apple's iPhone 17.

What to Watch

ZDI acquires the vulnerabilities demonstrated at Pwn2Own and gives vendors 90 days to release fixes before it publishes details. That puts Google, Samsung, Oracle, Brother, Canon, Lexmark, Philips and the Home Assistant project on the clock. Google's monthly Android and Pixel security bulletins will be the first place to look for fixes to the three Pixel 10 chains.