The Pulse
Pwn2Own’s Codex and LiteLLM Targets Fall for Exploits
Researchers exploited OpenAI Codex and LiteLLM on the first day of Pwn2Own Ireland, earning prizes of $15,000 to $40,000. The contest rules required exploits to cross security boundaries, rather than merely coaxing an agent into unsafe outp
AI.info Team · Written with AI ·
Pwn2Own Ireland set a demanding bar for its new AI targets: researchers had to cross security boundaries, not simply coax an agent into producing unsafe output. On October 6, the first day of the Cork contest, competitors demonstrated exploits against both OpenAI Codex and LiteLLM, earning prizes that ranged from $15,000 to $40,000. The results put real exploits behind targets that the Zero Day Initiative had announced in July.
Two AI targets, two security categories
ZDI placed LiteLLM in AI Infrastructure, alongside products including Chroma and Oracle Autonomous AI Database. OpenAI Codex joined Anthropic Claude Code in a separate Coding Agent category. The rules set a $40,000 prize and four Master of Pwn points for a successful entry against either Codex or LiteLLM.
For LiteLLM, an attempt had to start from a contestant’s laptop on the contest network, and researchers had to bypass authentication if the target supported it. Codex faced a different test: an exploit had to use a contestant-controlled resource, such as a repository or web page, to get arbitrary code execution beyond the agent’s intended sandbox and permissions. The target ran with default sandbox and isolation settings on Windows 11 25H2; unsafe execution modes were excluded.
“We introduced these targets at Pwn2Own Berlin, and we saw such…uh…enthusiasm from the community that we decided to immediately bring them back for our Ireland event.”
Dustin Childs, author of the Zero Day Initiative announcement
Codex yields $40,000; LiteLLM produces a collision
ZDI said Ikotas Labs exploited Codex with a single argument-injection bug, earning the full $40,000 and four points. The contest’s public results described the exploit method but did not publish a technical account of how the bug worked. The result establishes a successful exploit in the contest’s test setup; it does not, by itself, establish exposure across every Codex configuration or deployment.
LiteLLM drew multiple attempts. Taisic Yun of Xint combined an improper-input-validation bug with code injection to obtain a reverse shell, taking the full $40,000 prize. HaeJung Yang and ByungYoung Yi of Out of Bounds also demonstrated an exploit, but ZDI classified it as a collision: two of the team’s four bugs were previously known, so its award fell to $15,000 and three points.
The rules draw a line between a flaw and a prompt
The Coding Agent category excludes model jailbreaks and prompts that merely persuade a model to act maliciously. It also excludes third-party extensions and MCP servers not bundled with the target, as well as vulnerabilities requiring unsafe or permissionless modes. Contestants instead had to demonstrate a qualifying vulnerability in the agent and an action outside its intended security boundaries.
That distinction matters when reading the results: ZDI describes the Codex exploit as argument injection and the LiteLLM exploit as input validation followed by code injection, not as proof that ordinary prompting alone can break their safeguards. Pwn2Own Ireland runs through October 9, with the Codex and LiteLLM demonstrations recorded on its opening day.