Pwn2Own Berlin 2026 paid out $1.3 million across 47 zero-days. OpenAI Codex got hit three times.

THE NUMBERS THAT MATTER

Pwn2Own Berlin 2026 ran at OffensiveCon from May 14 through May 16. TrendAI's Zero Day Initiative awarded $1,298,250 across three days. The day-by-day totals were $523,000 across 24 zero-days on day one, $385,750 across 15 zero-days on day two, and $389,500 across eight zero-days on day three. The final tally of 47 unique zero-days is a substantial increase over last year's Pwn2Own Berlin contest, which awarded $1,078,750 across 29 zero-days.

DEVCORE took the Master of Pwn title with 50.5 points and $505,000 in winnings. The team's contribution is anchored by three exploit chains from Orange Tsai. A four-bug logic chain escaped the Microsoft Edge sandbox on day one for $175,000. A three-bug chain achieved remote code execution as SYSTEM on a fully patched Microsoft Exchange Server on day two for $200,000, the single highest-paid exploit of the contest. A separate chain exploited Microsoft SharePoint for $100,000. DEVCORE never relinquished its day-one lead.

STARLabs SG finished second with 25 points and $242,500. The team's signature exploit was Nguyen Hoang Thach's memory corruption bug against VMware ESXi with the cross-tenant code execution add-on, which earned $200,000 on day three. Out Of Bounds finished third with 12.75 points and $95,750. Multiple other teams contributed to the final tally including Viettel Cyber Security, Team DDOS, OtterSec, Summoning Team, IBM X-Force, and Ikotas Labs.

WHY THE AI CATEGORY MATTERS

The AI category was the most active in Pwn2Own's nineteen-year history. Every major class of AI tooling came under attack. AI-powered developer assistants. Local inference platforms. AI gateways. Vector databases. ML training frameworks. The breadth of the targeting reflects how rapidly AI tooling has moved from research project to enterprise production infrastructure across the past eighteen months.

OpenAI Codex was successfully exploited three separate times by three different researchers using three different techniques. The pattern is the practitioner observation that matters. Each researcher independently identified a different attack surface. Each successful exploit demonstrates an unrelated class of failure. The aggregate signal is that Codex's attack surface is broader than any single vulnerability would suggest. The Zero Day Initiative coverage notes that this pattern should prompt serious reflection inside OpenAI's security organization. The Atarus blog covered the operational version of this concern in the blast radius synthesis on May 10: AI coding agents inherit the blast radius of every credential and capability granted to the development environment, regardless of how narrow the immediate workflow appears.

LiteLLM came under attack twice during the contest, with a collision on day two indicating that multiple researchers had independently identified the same vulnerability path. LiteLLM is the same gateway product TeamPCP compromised through poisoned PyPI packages in March 2026 as documented in the GTIG AI Threat Tracker. The convergent attention from both criminal actors and contest researchers across a single AI gateway product is the kind of signal that should drive accelerated security investment in the platform.

LM Studio fell to OtterSec's code injection exploit on day two for $20,000. LM Studio is the desktop application most consumers and small teams use to run local large language models on consumer hardware. The same product class as Ollama, which Atarus covered in the Bleeding Llama post on May 6. NVIDIA Megatron Bridge fell on day one. Chroma fell on day one. Anthropic Claude Code attempted on day three by Byung Young Yi of Out Of Bounds resulted in a collision (the bug had been previously disclosed) and a partial $20,000 payout.

The contest data confirms what the Atarus body of work has been arguing across the past three weeks. AI tooling is being deployed at production scale faster than the security maturity of the platforms supports. The Pwn2Own results are the controlled-conditions evidence. The TeamPCP campaigns and the Dragos Monterrey disclosure are the uncontrolled-conditions evidence. The same deployment architecture failures appear across both contexts.

ORANGE TSAI'S EXCHANGE CHAIN

The single most consequential exploit of the contest deserves practitioner attention. Orange Tsai of DEVCORE chained three vulnerabilities to achieve remote code execution as SYSTEM on a fully patched Microsoft Exchange Server. The $200,000 payout reflects the operational severity of the demonstration. Exchange Server is one of the highest-leverage targets in enterprise environments. SYSTEM-level remote code execution is the maximum possible compromise. The fact that the exploit chains three bugs together rather than relying on a single vulnerability is the tradecraft signature of a research-grade adversary rather than a script kiddie operation.

The Atarus blog has covered Exchange Server vulnerabilities multiple times over the past two years. The platform has been one of the most consistently targeted enterprise applications in the entire body of work. Exchange Server holds organizational email, calendar data, address books, and the integration glue that ties most enterprise authentication systems together. SYSTEM-level access on an Exchange Server is functionally equivalent to control of the entire identity infrastructure for most organizations.

The Pwn2Own result is now in coordinated disclosure with Microsoft. The ninety-day disclosure window means technical details will become public around mid-August 2026 unless Microsoft requests an extension or coordinates an earlier public release. Organizations running Exchange Server should plan for an emergency patching cycle when the disclosure happens. The exploit chain Orange Tsai demonstrated is the kind of technical achievement that drives follow-on research, similar exploit development by other researchers, and adversary tradecraft adaptation. The window between public disclosure and active exploitation in the wild for Exchange Server vulnerabilities has historically been days rather than weeks.

THE CAPACITY PROBLEM

Pwn2Own Berlin 2026 hit capacity for the first time in the contest's nineteen-year history. More than 150 researchers were turned away due to scheduling limits. Several rejected participants opted to disclose their proof-of-concepts publicly rather than wait for the next event. This is operationally significant for two reasons.

First, the volume signal. The capacity ceiling was hit because the supply of qualified researchers with working zero-day exploits has substantially outpaced the contest infrastructure built to absorb them. This is a measurable indicator of how the offensive research community has grown. The same skill base that produces Pwn2Own demonstrations is also available to nation-state programs, criminal extortion groups, and private sector pen testing firms. The contest is the visible portion of the iceberg.

Second, the disclosure consequence. Researchers who go public with their proof-of-concepts outside the Pwn2Own coordinated disclosure framework give vendors no advance notice. The technical details land in the public record at the same time the vulnerability becomes operational. The window between disclosure and weaponization compresses to hours rather than the ninety days the contest model produces. The capacity-induced public disclosures from rejected Pwn2Own participants are now operating on a different timeline than the contest's official outputs.

For defenders, the implication is that vulnerability intelligence feeds need to track public disclosures from this category of researcher separately. The Pwn2Own outputs will be coordinated. The Pwn2Own-rejected outputs may not be. The intelligence work to differentiate the two is non-trivial.

INDICATORS AND TIMELINE

WHAT THIS MEANS FOR DEFENDERS