Pixel 10 Exploits Dominate Pwn2Own Ireland 2026 Payouts
The Pwn2Own Ireland 2026 competition concluded with participants earning more than $1.2 million in total rewards for demonstrating exploits across a wide range of consumer and enterprise technologies. Among the various targets, the Google Pixel 10 emerged as the most lucrative, with three separate teams successfully demonstrating exploits against the device and collectively earning over $560,000 for their efforts.
Ikotas Labs Claims Full $300,000 Pixel 10 Payout
The Ikotas Labs team achieved the highest individual reward by earning the full $300,000 payout available for a Pixel 10 exploit. Their success came from chaining multiple previously unknown vulnerabilities to achieve remote code execution on the device without any user interaction, meeting the competition’s strict criteria for a zero-click, fully exploited chain.
Becker and Bieri Earn $150,000 for Pixel 10 Exploit
Tim Becker and Yves Bieri received $150,000 for their demonstrated exploit targeting the Google Pixel 10. Although their attack was successful, they did not qualify for the full payout because their exploit chain included a vulnerability that had been previously disclosed or known to the vendor or public before the event, which reduced the novelty score under Pwn2Own’s reward structure.
Valsamaras and Gannon Earn $112,500 for Hybrid Pixel 10 Exploit
The third Pixel 10 exploit was demonstrated by Dimitrios Valsamaras and Ken Gannon, who earned $112,500 for their work. Their exploit combined a zero-day vulnerability — one unknown to the vendor prior to the event — with a previously known flaw to achieve a successful compromise. This hybrid approach still warranted a significant reward due to the novelty and difficulty of the zero-day component.
Valsamaras and Gannon were not new to Pwn2Own success; the pair had previously earned $50,000 at the 2025 event for hacking a Samsung Galaxy S25 device. Following that win, they continued their research into Samsung’s software ecosystem, demonstrating how vulnerabilities in components such as the Bixby virtual assistant could be leveraged to compromise mobile devices.
Other Notable Exploits and Payouts at Pwn2Own Ireland 2026
Beyond the Pixel 10 targets, several other high-value exploits were rewarded. A researcher earned $50,000 for successfully hacking the Sonos Era 300 smart speaker. Multiple exploits targeting major AI and infrastructure platforms each received $40,000, including:
- Oracle Autonomous AI Database
- OpenAI Codex
- Nvidia’s Dynamo AI inference framework
- LiteLLM AI gateway
- Philips Hue Bridge Pro smart lighting hub
Exploits targeting the Samsung Galaxy S26 and the Home Assistant Green smart home hub each earned researchers approximately $30,000. Additionally, $20,000 was paid out for successful attacks on Lexmark and Brother printers, as well as the Garmin Index BPM blood pressure monitor.
A tier of rewards ranging from $4,250 to $17,500 was distributed for exploits affecting a broader set of devices and platforms, including:
- Sonos Era (various models)
- Galaxy S26
- LiteLLM
- Philips Hue Bridge Pro
- Lexmark CX532adwe
- Oracle Autonomous AI Database
- Home Assistant Green
- Chroma
- Garmin Index BPM
- Canon imageFORCE 1643F
The Zero Day Initiative, which organizes Pwn2Own, confirmed that all exploit details would be shared privately with the affected vendors following the event to allow for patch development and coordination before any public disclosure.
Notably, despite offering a maximum potential reward of $300,000, no participants attempted to exploit the iPhone 17 or WhatsApp during the Pwn2Own Ireland 2026 event, leaving those bounties unclaimed.
Source: SecurityWeek