LiteLLM and OpenAI Codex fall to injection bugs on Pwn2Own Ireland's first day
Pwn2Own Ireland teams logged 32 zero-days and over $368,000 in prizes on October 6, breaking LiteLLM, OpenAI Codex and Oracle's AI database. Vendors now have 90 days to ship fixes before the Zero Day Initiative publishes the details.
The Watch · Security desk
What happened
- Ikotas Labs exploited OpenAI Codex with a single argument injection bug.
- Taisic Yun of Xint chained an improper input validation bug with code injection to get a reverse shell on LiteLLM.
- Three VinSOC researchers combined five zero-days to exploit the Oracle Autonomous AI Database.
- ZDI counted 21 day-one entries, including several Samsung attempts and what it called its first Pixel entry.
- Ikotas Labs could not get its exploit of the Brother MFC-L8970CDW printer working in the time allotted.
Why it matters
- Who's exposed exposure A product name and a bug class are all LiteLLM and Codex users have until details publish, too little to scope affected versions or write detections.
- What it sets up precedent With AI tools in the target categories, their makers join phone and printer vendors on ZDI's coordinated-disclosure clock for every bug found at the contest.
- What doesn't add up contradiction The AI statistics paired with the results pull in opposite directions, with Google finding AI-found bugs skew to code execution and separate research finding few exploited, and neither set measures attacks on AI tools.
Next story · Security · Oct 8
Pwn2Own Ireland zero-days put Samsung, Google, OpenAI and Oracle on a 90-day patch deadlineConfirmed2 publishers
Both AI developer tools fell to injection-class bugs [5][6]. The hardware entries whose bug classes were published fell to memory-safety bugs [20]. @_McCaulay chained an out-of-bounds write with a format string bug on the Sonos Era 300 [9]. On the Garmin Index BPM, Interrupt Labs paired an out-of-bounds read with an out-of-bounds write [11]. Thanh Do of Team Confused needed one use-after-free for the Lexmark CX532adwe printer [10].
Bug count splits the field another way. Codex and the Lexmark each took one bug [5][10]. Two VinSOC researchers found seven zero-days on their way into the Philips Hue Bridge Pro [8].
AI software sat on the same day-one target list as smartphones, smart home devices and printers [2], and three AI products fell [19]. The record shows working exploits against named products under contest conditions. Neither report describes any of these bugs being used outside the contest.
ZDI discloses Pwn2Own findings to the affected vendors, who then have 90 days to release updates before ZDI publishes them [12]. Counted from October 6, the window closes on January 4, 2027 [22]. A vendor can ship sooner [12].
Infosecurity Magazine set the results beside Google figures on AI as a bug-finding tool [15]. According to Google, vulnerability disclosures doubled from 5,045 in January 2026 to 10,477 in July, then reached 10,740 in August [13]. Exploited vulnerabilities rose from an average of 10.5 a month in 2025 to 18 a month so far in 2026, by the same count [14]. Half the bugs Google identified as likely AI-discovered led to remote code execution, against 26% of other CVEs [15]. Separate research cited by the magazine puts the share of AI-discovered bugs exploited in the wild at 1% [21].
The day-one purse averages at least $11,500 per zero-day [18].
What to watch
- LiteLLM and OpenAI advisories naming affected versions and fixes, the first point at which operators can check their own exposure.
- Results from October 7 and 8, including whether more AI targets fall before the Master of Pwn is named.
- Any report of a day-one bug being exploited outside the contest before patches ship.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Pwn2Own Ireland 2026, run by the Zero Day Initiative, began in Cork on October 6.
- [2]
On day one, teams targeted smartphones, smart home devices, printers, and AI tools like OpenAI Codex and LiteLLM.
- [3]
On day one, 21 entries took the Pwn2Own stage, including multiple Samsung attempts and ZDI's first Pixel entry.
- [4]
Day one produced 32 zero-day vulnerabilities and over $368,000 in prize money.
- [5]
Ikotas Labs, Inc. used a single argument injection bug to exploit OpenAI Codex.
- [6]
Taisic Yun of Xint used an improper input validation bug and code injection to get a reverse shell on LiteLLM.
- [7]
Nam Nguyen, Thanh Vu, and Tin Huynh of VinSOC combined five zero days to exploit the Oracle Autonomous AI Database.
- [8]
Vu Chi Thanh and Huynh Duc Tin of VinSOC found seven zero days during their exploit of Philips Hue Bridge Pro.
- [9]
@_McCaulay combined an out-of-bounds write and a format string bug to exploit the Sonos Era 300.
- [10]
Thanh Do of Team Confused used a single use-after-free exploit on the Lexmark CX532adwe.
- [11]
Interrupt Labs used an OOB read and an OOB write to exploit the Garmin Index BPM.
- [12]
Pwn2Own findings are responsibly disclosed to the relevant vendors, who then have 90 days to release updates before the ZDI publishes them.
- [13]
According to Google, vulnerability disclosures doubled from 5045 in January 2026 to 10,477 in July, reaching 10,740 in August 2026.
- [14]
According to Google, exploited vulnerabilities rose from an average of 10.5 a month in 2025 to 18 a month so far in 2026.
- [15]
50% of vulnerabilities Google identified as likely AI-discovered resulted in remote code execution, against 26% of other CVEs.
- [16]
Pwn2Own continues on October 7 and 8, when the Master of Pwn will be announced.
- [17]
Ikotas Labs, Inc. could not get their exploit of the Brother MFC-L8970CDW working within the time allotted.
- [18]
Day-one prize money averaged at least $11,500 per zero-day.
- [19]
Three AI products were exploited on day one: LiteLLM, OpenAI Codex and Oracle Autonomous AI Database.
- [20]
The hardware entries with published bug classes (Sonos Era 300, Garmin Index BPM, Lexmark CX532adwe) were exploited with memory-safety bugs: out-of-bounds write plus format string, out-of-bounds read plus write, and use-after-free.
- [21]
Separate research claims that just 1% of AI-discovered vulnerabilities have been exploited in the wild.
- [22]
Counted from October 6, 2026, a 90-day window ends on January 4, 2027.
Sources
2 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comPwn2Own Hackers Find 32 Zero-Day Vulnerabilities on Day One
1 article · October 7, 2026
- Pwn2Own Ireland 2026 - Day One Results
thezdi.com
1 article · October 6, 2026
Topics and entities
Topics
- AI tool security
- Zero-Day Vulnerabilities
- Hacking competitions
- Coordinated Vulnerability Disclosure
- Memory Safety
Entities
- Ikotas Labs, Inc.
- OpenAI
- Garmin Index BPM
- Lexmark CX532adwe
- LiteLLM
- Oracle
- Codex
- Brother MFC-L8970CDW
- Zero Day Initiative
- Pwn2Own
- Philips Hue Bridge Pro
- Oracle Autonomous AI Database