Pwn2Own contestants exploit OpenAI Codex, LiteLLM and other AI tools

At Pwn2Own Ireland 2026, held by the Zero Day Initiative (ZDI) in Cork from October 6 to 8, security researchers successfully exploited several AI products live on stage, including OpenAI Codex and LiteLLM. According to ZDI, the first day alone produced 32 unique zero-day vulnerabilities, meaning flaws the vendor did not yet know about.

Pwn2Own is a security contest run by ZDI, which is part of Trend Micro. Researchers demonstrate attacks against up-to-date products in their default configuration within a set time limit, and successful entries earn prizes and points toward the Master of Pwn title. Under the contest rules, winners hand ZDI a working exploit and a technical whitepaper, and ZDI discloses the vulnerabilities to the affected vendors so they can prepare fixes.

OpenAI Codex falls in the coding agent category

Codex is OpenAI's AI coding agent for developers, able to write code and run commands. The contest's AI coding agent category listed Anthropic's Claude Code and OpenAI Codex as targets. Under the rules, a valid entry must use a contestant-controlled resource, such as a web page, repository or media file, to exploit a flaw in the agent itself and execute code outside the agent's intended sandbox and permission boundaries. The agents run on Windows 11 in their default configuration with sandboxing enabled. Model jailbreaks and modes that switch off permission prompts are out of scope.

According to ZDI's day one results, Ikotas Labs exploited OpenAI Codex with a single argument injection bug. The published schedule listed no registered attempt against Claude Code.

LiteLLM and other AI infrastructure targets

LiteLLM is an open source proxy layer that lets applications reach models from many AI providers through one interface. Two teams targeted it on day one. A researcher from Xint combined an improper input validation bug with code injection to get a reverse shell on the server. The Out of Bounds team used a chain of four bugs, two of which, according to ZDI, were previously known.

In the same category, Oracle Autonomous AI Database was exploited several times over the three days; the first successful entry used a chain of five bugs. Some attempts against Chroma, an open source vector database, ran out of time, while two attempts on day two succeeded. A target named Dynamo was also exploited on day two. Under the rules, attacks in this category are launched from the contestant's laptop over the network and must bypass the target's authentication. ZDI marked a number of entries as collisions, meaning some of the bugs used had already been reported to the vendor or to ZDI.

The wider contest and how the bugs get fixed

Besides AI products, the contest targeted the Samsung Galaxy S26 and Google Pixel 10 phones, smart home devices, printers and a wellness device. According to ZDI's day three post, Ikotas Labs, the team behind the Codex exploit, won the Master of Pwn title.

Under ZDI's disclosure policy, once a vendor responds it has four months (120 days) to address the vulnerability. If the flaw is still unfixed at the deadline and the vendor gives no reasonable explanation, ZDI publishes a limited advisory.

ZDI's results posts do not include technical details of the bugs, and they do not say which Codex version or attack scenario was used. The day three post gives no event-wide total for vulnerabilities found. Teams using these products should watch for and apply the security updates the vendors release. For a fuller picture, follow evaluations from independent researchers as well.

Sources: ZDI: Pwn2Own Ireland 2026 day one results, ZDI: day two results, ZDI: day three results and Master of Pwn, ZDI: Pwn2Own Ireland 2026 rules, ZDI: disclosure policy.