Google Pixel 10 and Samsung Galaxy S26 Breached as Ikotas Labs Claims Top Honors at Pwn2Own Ireland 2026

The competitive landscape of cybersecurity research reached a fever pitch this week in Cork, Ireland, as the world’s most elite ethical hackers gathered for Pwn2Own Ireland 2026. Over the course of three days, the event, organized by Trend Micro’s Zero Day Initiative (ZDI), served as a high-stakes proving ground for vulnerability research, with participants targeting everything from flagship smartphones and AI-driven databases to smart home infrastructure. By the conclusion of the event on October 8, 2026, the collective efforts of the research community resulted in more than $1.2 million in awarded prizes, underscoring both the sophistication of modern exploits and the critical importance of the "bug bounty" ecosystem in securing global technology.

The centerpiece of this year’s competition was the successful compromise of the Google Pixel 10, a device marketed for its robust security architecture. Over the course of the event, three separate research teams managed to penetrate the device’s defenses, demonstrating that even the most current, fully patched hardware remains susceptible to advanced attack chains. The most significant of these victories belonged to Ikotas Labs, whose technical prowess not only earned them a $300,000 top prize for their Pixel exploit but also propelled them to the title of "Master of Pwn," the contest’s highest individual honor.

The Breach of the Pixel 10

The rules of Pwn2Own are famously stringent: every target device must be running the most recent firmware and security updates available at the time of the attempt. For the Google Pixel 10, this meant researchers were working against a platform that had received its most recent security bulletin just two days prior, on October 6. Despite these hurdles, the Pixel 10 was successfully exploited three times in the remote attack category, a classification that requires the attacker to gain entry without physical access to the device, typically through web content or wireless radio links such as Wi-Fi, Bluetooth, NFC, or baseband.

The first successful breach was executed by the team known as Xint, comprised of researchers Tim Becker and Yves Bieri. Their attempt was initially met with high anticipation, though the final payout was adjusted to $150,000 and 15 points—exactly half of the maximum possible reward. This reduction was due to what the ZDI calls a "bug collision." In the context of Pwn2Own, a collision occurs when a researcher utilizes a vulnerability that has already been discovered by another party, such as the vendor or the contest organizers themselves. While the exploit remains valid and impressive, the prize is halved to reflect that the bug was not a "zero-day" unknown to the industry.

Following Xint, Ikotas Labs took the stage for their attempt on the Pixel 10. Their performance was a masterclass in exploit engineering, as they successfully chained multiple vulnerabilities together to achieve their objective. Interestingly, while the ZDI’s official results labeled the Ikotas entry as a collision, the team was still awarded the full $300,000 prize and 30 points. The ZDI has not yet provided a detailed explanation for this discrepancy, though it often occurs when a team’s exploit chain includes enough unique or novel elements to justify the full award despite the presence of a known bug within the sequence.

The third successful Pixel exploit was a collaborative effort by Dimitrios Valsamaras, Ken Gannon, and Tenia Valsamara. This team utilized a sophisticated chain of two distinct bugs: one that was identified as a collision and another that was a true zero-day. This hybrid approach earned them $112,500 and 22.5 points. Collectively, the three successful attacks on the Pixel 10 resulted in a total payout of $562,500, a figure that highlights the premium placed on mobile security vulnerabilities in today’s market.

Master of Pwn: The Rise of Ikotas Labs

While the Pixel 10 exploits were the most lucrative, they were only one part of a broader dominant performance by Ikotas Labs. To secure the title of "Master of Pwn," a team must demonstrate versatility across multiple categories of technology. Ikotas Labs did exactly that, proving their capabilities extended far beyond mobile operating systems.

On the first day of the competition, the team successfully exploited the Samsung Galaxy S26, a feat they would later complement with attacks on emerging technologies. Most notably, Ikotas Labs turned their attention to the world of artificial intelligence, successfully compromising OpenAI’s Codex, a powerful coding agent. They followed this on the second day by breaching Oracle’s Autonomous AI Database. By the end of the three-day circuit, Ikotas Labs had amassed four major wins, totaling $361,000 in prize money and 42.5 points, comfortably securing their position at the top of the leaderboard.

The success of Ikotas Labs reflects a shifting trend in the cybersecurity world, where the boundaries between traditional software, mobile hardware, and AI-driven services are increasingly blurred. Their ability to pivot from a smartphone baseband exploit to a database-level breach of an AI system demonstrates the high level of multidisciplinary skill required in modern vulnerability research.

Samsung Galaxy S26 and the Challenge of Known Bugs

The Samsung Galaxy S26 faced an even more grueling gauntlet than the Pixel 10. Throughout the contest, seven different attempts were made to compromise the device, and every single one was successful. This 100% failure rate for the device’s defenses might seem alarming, but the context of the exploits provides a more nuanced picture.

Of the seven winning entries against the Galaxy S26, six involved at least one bug collision. This suggests that while researchers are finding ways into the device, many of the paths they are taking involve vulnerabilities that have already been identified by security teams but perhaps not yet fully mitigated in the production firmware. In one specific instance involving Ikotas Labs’ first-day exploit of the S26, the ZDI noted that one of the bugs used in their chain was already known to the vendor but remained unpatched at the time of the demonstration.

This highlights a persistent challenge in the mobile ecosystem: the "patch gap." Even when a vulnerability is discovered and reported, the time it takes to develop, test, and deploy a fix across millions of devices globally creates a window of opportunity for attackers. Pwn2Own serves as a public reminder of this window, pushing vendors to accelerate their remediation timelines.

The Disclosure Process and What Happens Next

For the manufacturers of the exploited devices, the end of Pwn2Own marks the beginning of a high-pressure race. Under the rules of the contest, all winning teams must turn over their exploit code and full technical write-ups to the Zero Day Initiative. The ZDI, in turn, immediately passes this information to the affected vendors, such as Google, Samsung, and Oracle.

From the moment of disclosure, vendors generally have a 90-day window to develop and release a patch to the public. During this period, the technical details of how the exploits work are kept strictly confidential to prevent malicious actors from replicating the attacks before a fix is available. Once the 90 days have elapsed, or once a patch has been successfully deployed, the ZDI typically publishes the full technical details of the vulnerabilities to educate the broader security community.

As of the conclusion of the contest, Google’s most recent security bulletin for the Pixel did not include fixes for the vulnerabilities demonstrated in Cork. This is expected, given that the exploits were revealed just as the bulletin was being finalized or released. Consequently, there are currently no specific steps for Pixel 10 or Galaxy S26 owners to take, other than the standard recommendation to keep their devices updated to the latest available security patch level.

A Broad Spectrum of Targets

While smartphones and AI systems dominated the headlines, Pwn2Own Ireland 2026 also featured a diverse array of "Internet of Things" (IoT) and office equipment targets. The ubiquity of these devices in both homes and corporate environments makes them attractive targets for hackers seeking a foothold in a network.

Researchers successfully demonstrated exploits against printers from Lexmark, Canon, and Brother, proving that these often-overlooked devices remain a viable entry point for attackers. The smart home category also saw significant activity, with successful breaches of the Sonos Era 300 smart speaker, the Philips Hue Bridge Pro, and the Home Assistant Green hub. Even wellness technology was not immune; the Garmin Index BPM, a smart blood pressure monitor, was successfully exploited during the event.

The statistical breakdown of the contest illustrates the high level of preparation among the participants. Out of 63 scheduled attempts across all categories, 51 were successful. Interestingly, some of the most high-profile targets on the schedule saw no action at all. There were no registered attempts to exploit Apple’s iPhone 17 or the WhatsApp messaging platform, both of which carried top prizes of $300,000. The absence of attempts on these targets often suggests that the research required to breach them is so intensive—or the value of the exploit on the private market is so high—that researchers may choose not to reveal their findings in a public forum.

Contextualizing the Current Threat Landscape

The events in Cork take place against a backdrop of increasing urgency in mobile security. Just last month, Google was forced to rush out a patch for a critical flaw in the Pixel’s modem (CVE-2026-58704) after reports surfaced that it was being targeted in limited, real-world attacks. That specific flaw allowed for remote exploitation, similar to the categories contested at Pwn2Own.

The fact that three teams were able to find entirely new (or partially new) ways to compromise the Pixel 10 so soon after such a significant patch underscores the "cat-and-mouse" nature of cybersecurity. As manufacturers introduce new hardware features and more complex software layers, the attack surface inevitably expands.

Pwn2Own Ireland 2026 has once again demonstrated that no device is truly "unhackable." However, by incentivizing the world’s best researchers to disclose their findings to vendors rather than selling them to malicious actors, the contest plays a vital role in the global effort to harden the technology that billions of people rely on every day. For now, the industry waits for the 90-day clock to tick down, at which point the lessons learned in Cork will become part of the foundational knowledge used to build the next generation of secure systems.