The Google Pixel 10 was the primary focus for researchers, with three distinct teams successfully demonstrating exploits against the device. These efforts resulted in a combined total of $560,000 in prize money.
Ikotas Labs secured the top prize of $300,000. They executed a remote attack by chaining multiple vulnerabilities to gain full control of the smartphone. Tim Becker and Yves Bieri earned $150,000 for their discovery, though they missed the full reward because part of their exploit relied on a previously documented security flaw.
Dimitrios Valsamaras and Ken Gannon claimed $112,500 by combining a zero-day vulnerability with a known defect. This same duo previously earned $50,000 for compromising a Samsung Galaxy S25, where they notably exploited the Bixby virtual assistant.
The competition revealed weaknesses in various other platforms. One researcher earned $50,000 for successfully accessing a Sonos Era 300 smart speaker. Additionally, $40,000 prizes were awarded for exploits targeting complex systems. These included the Oracle Autonomous AI database, Nvidia Dynamo AI inference framework, OpenAI Codex, the LiteLLM gateway, and the Philips Hue Bridge Pro.
Smart home security also faced scrutiny. Researchers collected $30,000 for compromising the Samsung Galaxy S26 and the Home Assistant Green hub. Furthermore, $20,000 rewards were issued for hacking printers from Brother and Lexmark, as well as the Garmin Index BPM blood pressure monitor.
Throughout the event, organizers awarded smaller prizes ranging from $4,250 to $17,500 for various vulnerabilities in equipment like the Canon imageFORCE 1643F. All affected manufacturers will receive detailed technical documentation to help them patch these security flaws.
Notably, the i Phone 17 and WhatsApp remained untouched during the competition. Both targets offered a maximum reward of $300,000 each, but no researchers attempted to breach them. This event underscores the vital need for rigorous testing as AI and interconnected systems become more integrated into daily life. By exposing these risks, Pwn2 Own forces developers to prioritize user security before malicious actors can exploit the same vulnerabilities in the wild.