Google Pixel 10 and Samsung Galaxy S26 Breached as Ikotas Labs Claims Top Honors at Pwn2Own Ireland 2026

On the first day of the competition, the team successfully exploited the Samsung Galaxy S26, a feat they would later complement with attacks on emerging technologies. Most notably, Ikotas Labs turned their attention to the world of artificial intelligence, successfully compromising OpenAI’s Codex, a powerful coding agent. They followed this on the second day by breaching Oracle’s Autonomous AI Database. By the end of the three-day circuit, Ikotas Labs had amassed four major wins, totaling $361,000 in prize money and 42.5 points, comfortably securing their position at the top of the leaderboard.

The success of Ikotas Labs reflects a shifting trend in the cybersecurity world, where the boundaries between traditional software, mobile hardware, and AI-driven services are increasingly blurred. Their ability to pivot from a smartphone baseband exploit to a database-level breach of an AI system demonstrates the high level of multidisciplinary skill required in modern vulnerability research.

Samsung Galaxy S26 and the Challenge of Known Bugs

The Samsung Galaxy S26 faced an even more grueling gauntlet than the Pixel 10. Throughout the contest, seven different attempts were made to compromise the device, and every single one was successful. This 100% failure rate for the device’s defenses might seem alarming, but the context of the exploits provides a more nuanced picture.

Of the seven winning entries against the Galaxy S26, six involved at least one bug collision. This suggests that while researchers are finding ways into the device, many of the paths they are taking involve vulnerabilities that have already been identified by security teams but perhaps not yet fully mitigated in the production firmware. In one specific instance involving Ikotas Labs’ first-day exploit of the S26, the ZDI noted that one of the bugs used in their chain was already known to the vendor but remained unpatched at the time of the demonstration.

This highlights a persistent challenge in the mobile ecosystem: the "patch gap." Even when a vulnerability is discovered and reported, the time it takes to develop, test, and deploy a fix across millions of devices globally creates a window of opportunity for attackers. Pwn2Own serves as a public reminder of this window, pushing vendors to accelerate their remediation timelines.

The Disclosure Process and What Happens Next

For the manufacturers of the exploited devices, the end of Pwn2Own marks the beginning of a high-pressure race. Under the rules of the contest, all winning teams must turn over their exploit code and full technical write-ups to the Zero Day Initiative. The ZDI, in turn, immediately passes this information to the affected vendors, such as Google, Samsung, and Oracle.

From the moment of disclosure, vendors generally have a 90-day window to develop and release a patch to the public. During this period, the technical details of how the exploits work are kept strictly confidential to prevent malicious actors from replicating the attacks before a fix is available. Once the 90 days have elapsed, or once a patch has been successfully deployed, the ZDI typically publishes the full technical details of the vulnerabilities to educate the broader security community.