# Pwn2Own Berlin 2026: Hackers Cash in $1.3 Million as AI Security Becomes the New Battleground
White hat researchers demonstrated critical vulnerabilities in enterprise software and emerging AI platforms, with the competition drawing record interest despite capacity constraints.
## The Event: Record Payouts and Record Demand
Pwn2Own Berlin 2026 has concluded with participants earning a total of $1.298 million for discovering and demonstrating 47 unique vulnerabilities across enterprise infrastructure, operating systems, and artificial intelligence platforms. The biannual hacking competition, organized by Trend Micro's Zero Day Initiative (ZDI), showcased both the severity of vulnerabilities in widely-deployed software and the growing security risks in rapidly-scaling AI systems.
What distinguished this year's competition was unprecedented demand: organizers reported that all available time slots filled before the event began, forcing qualified researchers without registration to pursue alternative channels—some electing to disclose vulnerabilities directly to vendors, while others chose public disclosure rather than wait for future events.
## Top Performers: Enterprise Exploits Command Premium Payouts
Two teams dominated the leaderboard, collectively capturing nearly $750,000 in payouts.
Devcore, a Taiwan-based security research group, led individual team earnings with multiple six-figure awards:
Devcore's Microsoft Exchange exploit was particularly significant: Exchange Server remains a critical attack surface for enterprises, and System-level RCE chains represent the highest-severity category in vulnerability assessment frameworks. Successful exploitation grants attackers the ability to move laterally across corporate networks, access sensitive business data, and persist through standard remediation attempts.
StarLabs SG, a Singapore-based team, secured the second-highest earnings with a standout achievement:
VMware had pre-announced that Pwn2Own participants could earn up to $200,000 for ESX vulnerabilities, signaling the vendor's priority for hypervisor security research. The cross-tenant aspect of this exploit is particularly alarming: cloud and hosting providers depend on ESX isolation to prevent one customer's compromised VM from affecting others.
Out Of Bounds placed third with $95,750 in total winnings across multiple exploit categories.
## Exploit Breakdown: A Cross-Section of Modern Attack Surfaces
Beyond the headline million-dollar team payouts, the 47 vulnerabilities demonstrated encompassed diverse targets reflecting enterprise IT's expanding complexity:
| Target Category | Notable Payouts | Key Examples |
|---|---|---|
| Microsoft Products | Up to $200,000 | Exchange RCE, Edge sandbox escape, SharePoint |
| Linux & Red Hat | $2,500–$50,000 | Red Hat Enterprise Linux, Red Hat Linux Workstations |
| Virtualization | Up to $200,000 | VMware ESX, cross-tenant RCE |
| NVIDIA Software | $20,000–$50,000 | Megatron Bridge, Container Toolkit |
| AI/ML Platforms | $15,000–$40,000 | LiteLLM, OpenAI Codex, LM Studio, Ollama, Chroma |
Eight exploits were attempted but failed to demonstrate working vulnerabilities within the competition's time constraints, targeting Oracle Autonomous AI Database, Safari, Firefox, and others.
## The AI Security Reckoning: A New Category Matures
The most telling trend at Pwn2Own Berlin was the explosion of AI product submissions. Researchers earned rewards for vulnerabilities in LiteLLM, OpenAI Codex, Claude Code, LM Studio, Cursor, Ollama, NVIDIA Megatron Bridge, and Chroma—with individual payouts ranging from $15,000 to $40,000.
This reflects a critical inflection point: as enterprises and developers rapidly integrate large language models and AI tooling into production systems, the security posture of these platforms has become a legitimate focus for offensive security research. Many AI frameworks are relatively young, built by teams prioritizing feature velocity over threat modeling, and deployed in scenarios where their security properties are poorly understood by end users.
The inclusion of Claude Code among exploited products underscores that even AI assistants purpose-built for code generation now carry meaningful attack surface. A compromised Claude Code instance could potentially return malicious code to developers, creating supply chain leverage for sophisticated attackers.
## The Competition Couldn't Keep Up
One under-reported aspect of Pwn2Own Berlin 2026 was capacity exhaustion. Security researchers worldwide continue to identify zero-day vulnerabilities faster than the competition calendar can accommodate them. Some qualified participants unable to register instead:
This suggests that Pwn2Own's annual and biannual schedule is no longer sufficient to absorb the research volume. Organizations investing in vulnerability research may need to expand private bug bounty programs or direct engagement channels to capture findings that would otherwise go public.
## HackWire Analysis
Pwn2Own Berlin 2026 illustrates three critical shifts in cybersecurity risk.
First, enterprise software vendors continue to ship exploitable vulnerabilities despite decades of secure development guidance. Microsoft Exchange earning a $200,000 bounty for System-level RCE is not a novel problem—email servers have been targeted for 30 years. Yet the fact that Pwn2Own still rewards six-figure payouts for Exchange vulnerabilities suggests that legacy code complexity, developer velocity pressure, and the challenge of shipping security at scale remain fundamentally unsolved. Organizations relying on Exchange, SharePoint, and Edge should assume active exploitation occurs in the wild targeting similar vulnerability classes.
Second, the virtualization and cloud infrastructure layer is becoming a primary target. VMware's $200,000 bounty for cross-tenant ESX exploitation is a recognition that hypervisor escapes represent existential risk to cloud providers and their customers. Shared infrastructure depends entirely on isolation enforcement. The fact that researchers can still find and demonstrate such exploits suggests either that virtualization vendors are under-resourcing security research, or that the problem space is harder than assumed. Either way, enterprises should demand that hosting providers and cloud vendors implement proactive hypervisor testing and vulnerability research partnerships.
Third, AI security is no longer theoretical. Vulnerabilities in LLM frameworks, code assistants, and AI infrastructure tools now command serious bounties because they command serious business risk. Developers deploying Claude Code, ChatGPT, open-source LMs, and similar tooling into their SDLC should assume that these platforms are actively targeted by researchers and (likely) state and criminal actors. Supply chain compromise via AI-assisted code generation is an emerging attack class that most organizations have not yet accounted for in their threat models.
The $1.3 million payout total represents not the *cost* of fixing these vulnerabilities, but the *tip of the iceberg*. Each researcher who filled a Pwn2Own slot represents dozens more who couldn't register. The exploit volume is accelerating while disclosure mechanisms remain constrained. Organizations should interpret Pwn2Own not as a reassuring sign that security research is contained and channeled appropriately, but as evidence that vulnerability discovery has outpaced responsible disclosure infrastructure.
— HackWire Editorial
## Industry Implications and Next Steps
For Enterprise Security Teams:
For Cloud and Hosting Providers:
For AI and Software Vendors:
## Related Coverage