Pwn2Own Berlin 2026: 47 Zero-Days, AI Assistants Exploited, and What It Means for AppSec

Pwn2Own Berlin 2026 closed on May 16 with $1.3 million awarded for 47 unique zero-days — and, for the first time, AI coding assistants OpenAI Codex and Anthropic Claude Code were on the target list… and got exploited. For application security teams, this is the moment AI dev tools officially became attack surface.

The Numbers: $1.3 Million, 47 Zero-Days, 3 Days

The final tally from Pwn2Own Berlin 2026:

• $1,298,250 awarded across all three days
• 47 unique 0-day vulnerabilities demonstrated
• DEVCORE claimed Master of Pwn with 50.5 points and $505,000
• STARLabs SG finished second with 25 points and $242,500
• Out Of Bounds took third with 12.75 points and $95,750

For context, Pwn2Own events typically yield 20–30 zero-days per competition. Hitting 47 in a single event signals that enterprise attack surfaces are rich with unpatched vulnerabilities — and that researchers are getting better at finding them, often with the help of AI-assisted fuzzing and analysis tools. It’s the same zero-day surge the industry has been tracking all year.

AI Coding Assistants: The New Enterprise Target

The most significant development at Pwn2Own Berlin 2026 was the inclusion of AI coding assistants as competition targets. Both OpenAI Codex and Anthropic Claude Code were in the crosshairs, and researchers demonstrated multiple successful exploits against them.

OpenAI Codex Exploited

Satoki Tsuji of Ikotas Labs successfully exploited OpenAI Codex by abusing an external control mechanism, achieving code execution on the host system. The exploit earned $20,000 and 4 Master of Pwn points. The key insight: when an AI coding assistant has access to execute code, any flaw in its input validation or authorization model becomes a potential remote code execution vulnerability.

Anthropic Claude Code: Multiple Successful Attacks

Anthropic Claude Code was targeted multiple times across the three days:

• Compass Security successfully demonstrated an exploit, earning $20,000 and 2 points (collision with a prior attempt)
• Out Of Bounds also exploited Claude Code successfully, earning $20,000 and 2 points (collision)

The collision pattern is particularly noteworthy. When multiple independent teams find the same vulnerability in a product during a single competition, it suggests the bug is relatively easy to discover — meaning it’s likely being exploited in the wild, or will be soon.

Top Payouts of the Event

Traditional Targets: Still Dangerous

While AI targets dominated headlines, the traditional enterprise targets showed that classic vulnerability classes remain as dangerous as ever.

VMware ESXi: Cross-Tenant Code Execution

The single highest-value payout of the competition went to Nguyen Hoang Thach of STARLabs SG, who used a memory corruption bug to exploit VMware ESXi with the cross-tenant code execution add-on. The $200,000 payout and 20 Master of Pwn points reflect the critical nature of virtualization platform compromises. In a multi-tenant environment, a single ESXi escape can expose every VM on the host.

Microsoft SharePoint: $100,000 Chain

DEVCORE’s splitline chained two bugs to exploit Microsoft SharePoint, earning $100,000 and 10 points. SharePoint remains a perennial favorite for attackers because it’s widely deployed in enterprise environments, often internet-facing, and frequently misconfigured. The chain demonstrates that modern exploits rarely rely on a single vulnerability — they combine multiple lower-severity bugs into a full compromise.

Linux and Windows: Kernel and Privilege Escalation

Red Hat Linux was exploited multiple times through integer overflows, use-after-free bugs, and uninitialized memory issues. Windows 11 was hit with a privilege escalation via integer overflow. These are the bread and butter of enterprise security: kernel-level bugs that bypass application-layer controls entirely.

What This Means for Application Security

1. AI Assistants Need Security Boundaries

The Pwn2Own results confirm what security researchers have been warning about: AI coding assistants that execute code on developer machines are essentially new attack surfaces. Organizations deploying these tools need to implement the same security controls they would for any privileged application — sandboxing, least-privilege access, input validation, and comprehensive audit logging.

The specific attack vector against Codex (external control abuse) and Claude Code (multiple independent exploits) suggests that the authorization models surrounding these tools are not yet mature. When your AI assistant can execute shell commands, read files, and modify code, any flaw in how it decides what to execute becomes critical.

2. Supply Chain Risk Extends to AI Models

If an attacker can compromise the behavior of an AI coding assistant — whether through prompt injection, model manipulation, or exploiting the assistant’s own infrastructure — they can inject malicious code into every project that uses that assistant. This is supply chain attack 2.0: instead of poisoning an npm package, you poison the tool that writes the code that uses npm packages.

3. Virtualization Security Is Still Paramount

The VMware ESXi cross-tenant code execution exploit is a reminder that cloud and virtualization infrastructure remains a high-value target. For organizations running multi-tenant environments, hypervisor security is not optional — it’s the foundation of your isolation model.

4. Patch Management Velocity Matters More Than Ever

With 47 zero-days disclosed in a single event (on top of Microsoft’s 138 CVEs and Adobe’s 52 CVEs patched in May 2026 — see the May 2026 roundup), the volume of vulnerabilities requiring attention has outpaced most organizations’ patching capacity. This makes risk-based prioritization essential: focus on internet-facing assets, high-privilege systems, and vulnerabilities with known exploitation.

The AI-Security Feedback Loop

There’s a meta-narrative developing in the security community. Researchers are increasingly using AI tools to find vulnerabilities faster (fuzzing, code review, pattern recognition at scale). Simultaneously, the AI tools themselves are becoming targets. This creates a feedback loop:

1. AI helps find bugs faster → more vulnerabilities disclosed
2. More vulnerabilities in AI tools → AI tools become targets
3. Compromised AI tools can inject code → supply chain risk escalates
4. Need more security for AI tools → requires finding bugs in AI tools (back to step 1)

This loop is accelerating. The TrendAI ZDI program — which produced two of Microsoft’s May 2026 CVEs — demonstrates that AI-assisted vulnerability discovery is already producing results at scale.

Actionable Takeaways for Security Teams

• Audit AI coding assistant deployments: Review what permissions your AI assistants have, what systems they can access, and what approval gates exist before they execute commands or modify code.
• Sandbox AI tool execution: Never let an AI coding assistant run commands directly on a production or developer machine without container isolation and network restrictions.
• Review hypervisor patching: Ensure your ESXi, Hyper-V, and KVM deployments are patched. The Pwn2Own ESXi exploit will be disclosed to VMware, but similar bugs may exist.
• Assess SharePoint exposure: If SharePoint is internet-facing, verify that it’s fully patched and that access controls are properly configured.
• Implement zero-trust for AI tools: Treat AI assistant outputs the same way you’d treat code from an untrusted third party — review it, test it, and don’t grant it elevated privileges.

Looking Ahead

Pwn2Own Berlin 2026 signals a shift in the security landscape. The fact that AI coding assistants were included as targets — and were successfully exploited multiple times — tells us that the industry recognizes these tools as security-critical infrastructure. The question is whether organizations using these tools will apply the same rigor to securing them as they do to their web applications, databases, and networks.

The answer, based on what we saw in Berlin, needs to be yes. Because the researchers who demonstrated these exploits won’t be the last ones to find them — they’re just the first ones to do it on stage.

Frequently Asked Questions

What were the Pwn2Own Berlin 2026 results?

$1,298,250 was awarded for 47 unique zero-days over three days (May 14–16, 2026). DEVCORE won Master of Pwn with 50.5 points and $505,000; STARLabs SG was second (25 pts, $242,500) and Out Of Bounds third (12.75 pts, $95,750).

Were AI coding assistants really exploited at Pwn2Own?

Yes — a first for the competition. Satoki Tsuji (Ikotas Labs) exploited OpenAI Codex via an external-control abuse achieving host code execution ($20,000), and Anthropic Claude Code was exploited independently by both Compass Security and Out Of Bounds ($20,000 each), with collisions indicating an easy-to-find bug.

What was the biggest payout at Pwn2Own Berlin 2026?

$200,000 to Nguyen Hoang Thach of STARLabs SG for a VMware ESXi memory-corruption exploit with the cross-tenant code execution add-on — 20 Master of Pwn points and the event’s top prize, reflecting how catastrophic a hypervisor escape is in multi-tenant environments.

How should teams secure AI coding assistants after this?

Sandbox all AI-tool execution (container isolation + network restrictions), enforce least-privilege and approval gates before commands run, audit what the assistant can access, log everything, and treat generated code as untrusted third-party input pending review.

References

• ZDI / Trend Micro — Pwn2Own Berlin 2026 final results and payouts
• ZDI — Master of Pwn scoreboard, May 16, 2026
• Hmmnm — Zero-Day Surge 2026: Critical Vulnerabilities
• Hmmnm — May 2026 Cybersecurity Roundup
• Hmmnm — Prompt Injection Attacks Explained
• Hmmnm — Red Teaming LLM Applications Playbook