Security researchers walked away with $523,000 in cash on the first day of Pwn2Own Berlin 2026 after demonstrating 24 unique zero-day vulnerabilities across browsers, operating systems, NVIDIA infrastructure and a new AI category. The contest, held at the OffensiveCon conference from May 14 to 16, has a total prize pool exceeding $1 million and is focused on enterprise technologies and artificial intelligence.
The standout result came from Orange Tsai of the DEVCORE Research Team, who chained four separate logic bugs to escape the Microsoft Edge sandbox in a single attempt, earning $175,000 and 17.5 Master of Pwn points. DEVCORE leads the competition with $205,000 so far, followed by Valentina Palmiotti at $70,000. Other successful exploits included a privilege escalation on Windows 11 by Angelboy and TwinkleStar03 ($30,000), Compass Security exploiting OpenAI Codex with a single CWE-150 bug ($40,000), and STARLabs SG chaining five bugs including SSRF and code injection against LM Studio ($40,000).
The AI category proved particularly fruitful, with researchers also taking down LiteLLM, marking the first major Pwn2Own where AI gateways and LLM tooling were treated as first-class targets alongside Windows and Edge. With the full schedule still ahead, 2026 is on track to exceed last year's Berlin edition payouts.