--- url: "https://www.xcademia.com/news/pwn2own-ireland-trendai-awards-1-26-million-for-98-zero-day-vulnerabilities" title: "Pwn2Own Ireland: TrendAI Awards $1.26 Million for 98 Zero-Day Vulnerabilities" description: "TrendAI awards $1.26 million at Pwn2Own Ireland as researchers uncover 98 zero-day vulnerabilities across connected devices and AI technologies." publishedAt: "2026-10-14T10:48:43.293+00:00" updatedAt: "2026-10-14T12:31:04.812213+00:00" type: news category: cybersecurity source_name: TrendAI / Trend Micro Newsroom source_url: "https://newsroom.trendmicro.com/2026-10-13-TrendAI-TM-Zero-Day-Initiative-TM-awards-over-1-2-million-at-Pwn2Own" tags: - "#Pwn2Own" - "#ZeroDay" - "#Cybersecurity" - "#VulnerabilityResearch" - "#TrendAI" - "#AI Security" - "#PatchManagement" --- # Pwn2Own Ireland: TrendAI Awards $1.26 Million for 98 Zero-Day Vulnerabilities > TrendAI's Zero Day Initiative awarded $1.262 million at Pwn2Own Ireland after researchers uncovered 98 unique zero-day vulnerabilities across mobile devices, smart home technology, AI infrastructure and more. Source: **TrendAI / Trend Micro Newsroom** · 14 October 2026 TrendAI's Zero Day Initiative (ZDI) awarded $1,262,000 to security researchers at Pwn2Own Ireland after participants discovered and disclosed 98 unique zero-day vulnerabilities during a three-day competition. The event covered a broad range of technologies, including mobile phones, smart home devices, wellness products, printers, messaging systems, AI infrastructure and AI coding agents. ## What Happened at Pwn2Own Ireland? Pwn2Own is a security research competition in which participants demonstrate vulnerabilities and exploit techniques against selected products. TrendAI's Zero Day Initiative coordinates the competition and facilitates responsible disclosure so that affected vendors can investigate and develop fixes. At the Ireland event, researchers demonstrated weaknesses across multiple product categories. The findings illustrate how security testing can extend beyond traditional computers and enterprise software to include connected consumer devices and emerging AI technologies. The competition's reported results were: - **Total prize money:** $1,262,000. - **Unique zero-day vulnerabilities discovered:** 98. - **Competition duration:** Three days. - **Technology categories:** Mobile phones, smart home devices, wellness products, printers, messaging, AI infrastructure and AI coding agents. The announcement does not provide a complete vulnerability-by-vulnerability breakdown or a full list of affected vendors and products in its summary. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791971576829-info1--121-.webp) ## Ikotas Labs Wins Master of Pwn Ikotas Labs, Inc. earned the Master of Pwn title and $300,000 in prize money after successfully chaining multiple issues to exploit the Google Pixel 10 at the end of the competition. According to TrendAI, the team became the first Japanese team to claim the Master of Pwn title. Xint finished second, earning $150,000 after demonstrating a remote exploit of the Google Pixel 10 through a single bug collision. Another notable demonstration came from Interrupt Labs, which received $5,000 after taking over a Lexmark CX532adwe printer and running the game DOOM on its display. These demonstrations show different ways researchers can establish control over a target. However, a successful demonstration in a controlled competition does not, by itself, establish that the same technique is being exploited in active attacks. ## Why Zero-Day Vulnerability Research Matters A zero-day vulnerability is a security flaw for which an effective fix may not yet be available when the weakness is discovered or becomes known. Such flaws can be especially challenging for defenders because established security controls may not fully address them. Responsible vulnerability disclosure helps coordinate the process between researchers and affected vendors. Researchers report their findings, vendors investigate the issues and develop appropriate fixes, and security teams can then update or protect affected systems. TrendAI says the disclosures made through its ZDI programme, including those from Pwn2Own, help vendors understand and fix vulnerabilities before cybercriminals exploit them. The process is important because a vulnerability can affect more than the device used in a demonstration. Depending on the flaw and the product's role, weaknesses in connected devices, applications or supporting infrastructure may create risks for wider environments. **What this means for defenders:** Organisations should maintain an inventory of their hardware and software, monitor vendor security advisories, prioritise relevant fixes and verify that remediation has reached the systems that need it. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791971603052-info2--122-.webp) ## AI Infrastructure and Coding Agents Enter the Spotlight One significant aspect of the competition was its inclusion of AI infrastructure and AI coding agents alongside established technology categories. AI systems increasingly rely on connected services, supporting infrastructure, software components and developer tools. Vulnerabilities in these environments can introduce security risks that organisations need to assess alongside more familiar endpoint, network and application threats. The announcement confirms that these categories were included, but it does not identify every affected AI product or disclose detailed technical findings for each demonstration. Additional details were not disclosed in the announcement. The broader industry implication is that vulnerability research needs to keep pace with changes in the technology stack. Security teams should consider AI-related components as part of their asset inventories and vulnerability management processes rather than treating them as separate from the wider security environment. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791971644749-info3--121-.webp) ## Virtual Patching and the Vendor Remediation Gap TrendAI also highlighted the role of virtual patching in its vulnerability protection strategy. A virtual patch uses security controls to block or mitigate attempts to exploit a known vulnerability without modifying the vulnerable application's underlying source code. Depending on the technology and the vulnerability, this can provide a temporary defensive measure while organisations wait for, test or deploy an official vendor update. TrendAI states that its TrendAI Vision One customers receive protection through virtual patching an average of 115 days ahead of the rest of the industry. This is a company-reported figure, and the announcement does not provide the underlying methodology or additional detail needed to independently evaluate the comparison. Virtual patching should not be confused with a permanent software fix. Organisations still need to track vendor updates, test patches where necessary and confirm that vulnerable systems have been remediated. For security leaders, the practical priority is to avoid leaving known vulnerabilities unresolved simply because a temporary control is available. ## What Security Teams Should Do Next The Pwn2Own findings provide a useful reminder that vulnerability management requires ongoing coordination between researchers, vendors and organisations using affected products. Security and IT teams can apply several practical measures: 1. **Maintain an accurate asset inventory.** Include mobile devices, printers, connected hardware, applications, AI services and developer tools where applicable. 2. **Monitor official security advisories.** Track disclosures from vendors whose products are deployed in your environment. 3. **Prioritise remediation by risk.** Consider exposure, exploitability, business impact and the availability of mitigations when deciding which vulnerabilities to address first. 4. **Validate temporary protections.** If virtual patching or another compensating control is used, verify that it covers the affected systems and the relevant attack path. 5. **Confirm fixes are deployed.** Record remediation status and verify that patches or mitigations have reached all affected assets. 6. **Include AI-related systems in security reviews.** Assess the infrastructure and developer tools that support AI adoption, using the same disciplined vulnerability management approach applied to other business-critical technology. These steps are general security recommendations based on the announcement's subject matter, not additional measures that TrendAI specifically attributed to the competition. ## What Happens Next? TrendAI said the next Pwn2Own competition is expected in early 2027. The company did not provide a specific date in this announcement. The longer-term value of the Ireland event will depend not only on the number of vulnerabilities identified but also on how effectively the findings move through coordinated disclosure and remediation. The announcement does not provide a complete breakdown of the 98 vulnerabilities by severity, affected vendor or patch status. For organisations, the key lesson is straightforward: discovering vulnerabilities is an important step, but reducing risk requires timely disclosure, appropriate fixes, effective interim protections and consistent verification. As AI infrastructure and coding tools become part of more technology environments, independent vulnerability research remains an important source of information for defenders seeking to understand how their systems can fail and how those weaknesses can be addressed. ## Original source https://newsroom.trendmicro.com/2026-10-13-TrendAI-TM-Zero-Day-Initiative-TM-awards-over-1-2-million-at-Pwn2Own ## Tags `#Pwn2Own` · `#ZeroDay` · `#Cybersecurity` · `#VulnerabilityResearch` · `#TrendAI` · `#AI Security` · `#PatchManagement` --- ## About this content This Markdown news article is the citation-grade twin of [Pwn2Own Ireland: TrendAI Awards $1.26 Million for 98 Zero-Day Vulnerabilities](https://www.xcademia.com/news/pwn2own-ireland-trendai-awards-1-26-million-for-98-zero-day-vulnerabilities). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/pwn2own-ireland-trendai-awards-1-26-million-for-98-zero-day-vulnerabilities - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt