When the world’s top security researchers gathered in Berlin this week for Pwn2Own 2026, the message that emerged over three days was unmistakable: the attack surface has never been larger, and AI systems are now firmly in the crosshairs. After just two days of competition, the total prize payout had already crossed $908,750, with 39 unique zero-day vulnerabilities demonstrated against some of the most widely deployed software on the planet — and day three results are still coming in.
Pwn2Own, run by Trend Micro’s Zero Day Initiative (ZDI), is the premier ethical hacking competition in cybersecurity. Teams pay nothing to enter and earn cash prizes — sometimes substantial ones — for successfully exploiting fully patched, up-to-date versions of targeted software. Vendors receive 90 days to patch any vulnerabilities demonstrated before public disclosure. The event serves a dual purpose: it rewards security research that might otherwise be sold on underground markets, and it forces vendors to confront the reality that “fully patched” still means “potentially exploitable.”
A Star Is Born: Orange Tsai Dominates the Competition
The story of Pwn2Own Berlin 2026 so far belongs largely to Orange Tsai of the DEVCORE Research Team. On day one, Tsai made headlines by chaining four separate logic bugs to execute a full sandbox escape on Microsoft Edge, walking away with $175,000 and 17.5 Master of Pwn points — one of the most technically demanding single exploits in recent Pwn2Own history.
Then on day two, Tsai came back. He chained three additional bugs to achieve remote code execution with full SYSTEM privileges on Microsoft Exchange, the on-premises email server software still deployed by tens of thousands of organizations worldwide. That single feat earned him another $200,000, pushing his two-day total to $375,000 — nearly half of the event’s entire payout through day two.
What’s remarkable about Tsai’s Edge escape in particular is how he achieved it: using logic bugs only. No memory corruption. No AI-assisted fuzzing. The exploit demonstrated that even as vendors invest heavily in memory-safe coding practices and hardened browser architectures, classic logic flaws remain a rich vein for attackers who know where to look. Tsai himself noted this on social media: “That’s my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all.”
Windows 11 Falls Three Times in One Day
Microsoft’s flagship operating system had a rough opening day. Windows 11 was successfully exploited not once, not twice, but three times by three separate research teams — each demonstrating a distinct privilege escalation zero-day on a fully patched system.
Angelboy and TwinkleStar03 of the DEVCORE Internship Program, Marcin Wiązowski, and Kentaro Kawane of GMO Cybersecurity each earned $30,000 for their exploits. The pattern here matters: three different bugs, three different researchers, one operating system. Windows 11 is running on hundreds of millions of devices globally. The fact that three novel privilege escalation paths could be demonstrated in a single afternoon at a hacking competition should give enterprise administrators pause — and it underscores why patch management and endpoint detection remain non-negotiable.
Microsoft Exchange’s compromise on day two only deepened the concern. Exchange has been one of the most targeted enterprise software products in the world over the past several years, and Tsai’s day two demo showed that even with the latest patches applied, critical exploitation paths remain.
AI Systems Step Into the Crosshairs
Perhaps the most consequential development at Pwn2Own Berlin 2026 is not the browsers or the operating systems — it’s the AI platforms. For the first time in the competition’s history, AI-specific products featured as major targets, and they fell.
Researcher k3vg3n chained three vulnerabilities — including a server-side request forgery (SSRF) and a code injection flaw — to compromise LiteLLM, a popular open-source proxy for routing requests to large language model APIs. The attack earned $40,000 and four Master of Pwn points. Two independent research teams, Compass Security and maitai of Doyensec, each separately exploited OpenAI’s Codex coding agent for $40,000 apiece — a result that will raise eyebrows given Codex’s growing deployment in enterprise development pipelines. STARLabs SG rounded out the AI category with a successful $40,000 exploit of LM Studio, a local LLM inference platform.
NVIDIA’s AI infrastructure also took hits. IBM X-Force researcher Valentina Palmiotti exploited a zero-day in the NVIDIA Container Toolkit — the software layer that allows AI workloads to access GPU hardware inside containers — for $50,000. Satoki Tsuji and haehae independently found and demonstrated separate zero-days in NVIDIA’s Megatron Bridge, earning $20,000 each. Haehae also added a $20,000 exploit of Chroma, a popular open-source vector database widely used in AI retrieval systems.
The significance of these AI-focused compromises cannot be overstated. AI platforms are being deployed at an accelerating pace across enterprise environments, often with assumptions of security that don’t hold under scrutiny. LiteLLM, Chroma, and LM Studio are infrastructure components that sit beneath AI applications — their compromise could allow an attacker to intercept or manipulate AI outputs, exfiltrate sensitive data, or pivot into broader network environments. The fact that these platforms fell on day one of a public competition suggests they haven’t received the same level of adversarial security scrutiny as traditional enterprise software.
The Numbers in Context
After two days, Pwn2Own Berlin 2026 has paid out $908,750 in researcher prizes, documented 39 unique zero-day vulnerabilities, and targeted categories including browsers, operating systems, enterprise servers, AI platforms, and NVIDIA GPU infrastructure. Successful exploits were demonstrated across Microsoft Edge, Windows 11, Microsoft Exchange, Red Hat Enterprise Linux, NVIDIA Container Toolkit, NVIDIA Megatron Bridge, OpenAI Codex, LiteLLM, LM Studio, and Chroma.
For comparison, Pwn2Own Berlin 2025 paid out a total of $1,078,750 for 29 vulnerabilities across the entire event. With $908,750 already paid out in two days for 39 vulnerabilities, this year’s edition is on pace to set records on both dimensions — and day three targets still include Apple Safari, Mozilla Firefox, the Cursor AI code editor, and Anthropic’s Claude Code.
What Happens Next
Under ZDI’s coordinated disclosure policy, vendors now have 90 days to develop and release patches for every vulnerability demonstrated at the event. That 90-day window represents the gap during which the vulnerabilities remain secret — known only to the researcher, the vendor, and ZDI. After that window closes, full technical details are published.
For organizations running any of the targeted software — and that includes most enterprises — the takeaway is practical: watch for security patches from Microsoft, NVIDIA, OpenAI, and the AI platform vendors in the weeks ahead, and treat those patches as high priority. The specific CVE numbers and technical details may not be public yet, but it’s now a matter of public record that exploitable zero-days in these products were demonstrated under competition conditions.
The broader lesson from Pwn2Own Berlin 2026 is the same one the competition has been delivering for nearly two decades: security is never finished. Every fully patched system is a moving target, every new platform category brings new attack surface, and the researchers who find these vulnerabilities before the bad actors do are performing a genuine public service.
