Pwn2Own Berlin 2026 Exposes Security Weaknesses Across AI Tools
Summary
Pwn2Own Berlin contestants found vulnerabilities in AI coding tools, databases, inference software, and Nvidia’s Container Toolkit. The article highlights exposed services, host-access risks, shared weaknesses in coding agents, and LLMs’ growing role in vulnerability-f0
Key points
- Contestants attempted attacks against 10 AI-related targets, earning nearly $1.3 million in total.
- Researchers found vulnerabilities in Claude Code, OpenAI Codex, Cursor, Ollama, ChromaDB, LM Studio, Nvidia’s Container Toolkit, and Megatron Bridge.
- Some flaws in exposed Ollama and ChromaDB instances could enable access to the underlying host; ChromaDB vulnerabilities could also expose otherwise protected instances and sensitive data.
- Successful attacks on Nvidia’s Container Toolkit could reach a container or host, although an attacker would first need access to the container environment.
- The article attributes coding-agent weaknesses to powerful underlying developer tools and users’ difficulty evaluating risks agents ask them to accept.
- All teams used LLMs during their work, but reported high false-positive rates during vulnerability discovery; some used coding agents to assist exploit development.
Article Details
- Event Type
- Pwn2Own Berlin 2026 security competition in which researchers attempted exploits against AI-related software, including coding agents, databases, inference systems, and Nvidia targets.
- Impact
- Researchers reported successful vulnerability attempts against several targets. The article says successful exploitation of some exposed Ollama or Chroma instances, or of the Nvidia Container Toolkit, could enable access to the underlying host; Chroma data may also be sensitive. Specific vulnerability details were not disclosed because the disclosure period was ongoing.
CVE
CVE-2025-23266including CVE-2025-49844 (ZDI-25-933), a critical use-after-free vulnerability in Redis, and CVE-2025-23266 (ZDI-25-626), a privilege escalation flaw in the Nvidia Container Toolkit.CVE-2025-49844Last year’s competition yielded the first-ever findings under the new AI-specific category, including CVE-2025-49844 (ZDI-25-933), a critical use-after-free vulnerability in Redis, and CVE-2025-23266 (ZDI-25-626), a
People
Vendors
AnthropicIn the coding agent category, contestants tried their hand on all targets: Anthropic Claude Code, Cursor, and OpenAI Codex.NvidiaTools like Ollama and ChromaDB are widely exposed on the internet, and successful exploits against them or against the Nvidia Container Toolkit could grant access to the underlying host – not just the model.OpenAIAcross Claude Code, OpenAI Codex, and Cursor, exploitable weaknesses traced back to the same root causes: Overpowered underlying developer tools and misplaced trust between agents and users.OracleIn the AI Database category (which usually means vector stores), only Chroma and Oracle Autonomous AI Database were targeted by contestants.TrendAIPwn2Own has unequivocally arrived in the generative AI (GenAI) age.TrendAI™ Research has a full report on the event that took place at OffensiveCon 2026.
Products
Anthropic Claude CodeIn the coding agent category, contestants tried their hand on all targets: Anthropic Claude Code, Cursor, and OpenAI Codex.ChromaIn the AI Database category (which usually means vector stores), only Chroma and Oracle Autonomous AI Database were targeted by contestants.ChromaDBTools like Ollama and ChromaDB are widely exposed on the internet, and successful exploits against them or against the Nvidia Container Toolkit could grant access to the underlying host – not just the model.CursorIn Pwn2Own Berlin 2026, contestants used LLMs and agentic coding tools to find vulnerabilities, while AI tools including Claude Code, Codex, and Cursor were also on the target list.Fable 5Mythos has now been released to the public as Fable 5, although with restrictions that make it not particularly useful for security researchers.LiteLLMIn the local inference category, only LiteLLM, LM Studio, and Ollama were targeted.LM StudioIn the local inference category, only LiteLLM, LM Studio, and Ollama were targeted.Megatron BridgeMegatron Bridge and the Container Toolkit were the only targets attempted in the Nvidia category.Nvidia Container ToolkitTools like Ollama and ChromaDB are widely exposed on the internet, and successful exploits against them or against the Nvidia Container Toolkit could grant access to the underlying host – not just the model.OllamaTools like Ollama and ChromaDB are widely exposed on the internet, and successful exploits against them or against the Nvidia Container Toolkit could grant access to the underlying host – not just the model.OpenAI CodexAcross Claude Code, OpenAI Codex, and Cursor, exploitable weaknesses traced back to the same root causes: Overpowered underlying developer tools and misplaced trust between agents and users.Oracle Autonomous AI DatabaseIn the AI Database category (which usually means vector stores), only Chroma and Oracle Autonomous AI Database were targeted by contestants.