Pwn2Own Ireland reports controlled exploits across AI targets

The first day of Pwn2Own Ireland included successful demonstrations against two AI software targets: LiteLLM in the AI Infrastructure category and OpenAI Codex in the Coding Agent category. Zero Day Initiative (ZDI), which runs the contest, reported the outcomes in its Day One results. These were controlled contest demonstrations. The public report does not establish that either issue has been exploited against customers.

ZDI said Taisic Yun of Xint used improper input validation and code injection to obtain a reverse shell on LiteLLM. The entry earned $40,000 and four Master of Pwn points. The Out of Bounds team also demonstrated an exploit against LiteLLM using four bugs. Two were already known, so ZDI recorded the result as a success/collision and awarded $15,000 and three points. That is a separate contest entry, not evidence of four additional previously unknown bugs.

Ikotas Labs exploited OpenAI Codex with one argument-injection bug, earning $40,000 and four points. ZDI classifies Codex as a Coding Agent target. LiteLLM sits in AI Infrastructure, a broader group that includes model-serving and database products. The two categories represent different targets and contest criteria.

What the public recap establishes

The recap names the high-level bug classes and outcomes, but it does not give affected product versions, CVE identifiers, detailed exploit steps, or product-specific patch guidance. ZDI’s rules say contest targets are demonstrated on site, target details are communicated to contestants, and successful entrants provide exploit materials and whitepapers for disclosure to affected vendors. The public results therefore support a report of controlled demonstrations and vendor disclosure, not an in-the-wild exploitation claim.

Teams using either product should follow the vendors’ own advisories for version and remediation guidance. The contest recap alone does not identify the tested versions or say whether a fix for these specific findings is available.

October 7: more AI infrastructure results

ZDI reported a successful demonstration against NVIDIA Dynamo by HaeJung Yang of Out of Bounds. At Oracle Autonomous AI Database, Taisic Yun of Xint used two unique zero-days and three collisions; Ikotas Labs used a seven-bug chain ending in a use-after-free and type confusion. ZDI also reported Team MAMMOTH’s Chroma success using one zero-day and two collisions. These were controlled contest results. The public recap does not list affected versions, CVEs, fixes or detailed exploit steps.

October 8: two more Oracle results

ZDI’s Day Three results report successful Oracle Autonomous AI Database demonstrations by OtterSec and Platform Security. OtterSec used a four-bug chain with three collisions and one zero-day. Platform Security used a five-bug chain with four collisions and one unique component; ZDI does not describe that component as a zero-day. The public results do not establish exploitation against customer deployments or provide product versions, CVEs or patch status.