32 Zero-Days on Day One of Pwn2Own Ireland, and OpenAI Codex Fell to a Single Argument-Injection Bug

Pwn2Own Ireland 2026, run by Trend Micro's Zero Day Initiative, opened on October 6. Contestants demonstrated 32 unique zero-days and collected $388,500 on day one, and both OpenAI's Codex coding agent and the open-source LLM gateway LiteLLM went down.

Three key facts

Codex fell to one bug. According to ZDI's official results, Ikotas Labs compromised OpenAI Codex with a single argument-injection flaw and earned $40,000. No exploit chain, no elaborate detour. One opening was enough.

LiteLLM was breached twice in one day. Taisic Yun of Xint combined an improper input validation flaw with code injection to get a reverse shell on LiteLLM, winning $40,000. The Out of Bounds team then used four bugs, two of them already found by others, to break it again for $15,000. Many companies use LiteLLM as the middle layer routing calls to every major model API, which means hanging every vendor's key on one key ring.

The traditional targets dropped too. BleepingComputer reports the Samsung Galaxy S26 was hacked twice on day one, alongside the Philips Hue Bridge, Oracle Autonomous AI Database, a Sonos speaker and several printers. A two-person VinSOC team took $80,000 combined with a seven-zero-day Hue Bridge chain and a five-zero-day Oracle database exploit. Vendors get 90 days to ship patches before ZDI publishes details.

WangDou's Take

Every launch event says coding agents can autonomously complete an entire project. Turns out one argument is all it takes to make Codex autonomously complete someone else's project. $40,000 buys an entry point that types commands on your machine for a stranger, less than a year of a junior developer. LiteLLM had it worse: breached twice in a day, like leaving the company's whole ring of model keys on the doorknob and getting robbed by two crews, the second one picking through what the first left behind. The more permissions we hand AI agents, the bigger these prize pools ought to get.

Source: Zero Day Initiative · Pwn2Own Ireland 2026 Day One Results · BleepingComputer