Pwn2Own Berlin Exposes Host-Level Risks in AI Developer Tools and Infrastructure

Pwn2Own Berlin 2026 showed that generative AI has become both an attack target and an offensive aid, as contestants used LLMs and coding agents to accelerate code review, translation, and exploit development while probing AI products including Claude Code, OpenAI Codex, Cursor, Ollama, ChromaDB, LM Studio, Megatron Bridge, and Nvidia Container Toolkit. Researchers reported that AI assistance improved speed but still generated many false positives during bug discovery, reinforcing that human validation remains necessary in vulnerability research.

The competition highlighted recurring weaknesses across AI ecosystems, particularly overprivileged developer tools, unsafe trust relationships between agents and users, and exposed infrastructure that can turn an application flaw into host-level compromise. Internet-facing deployments such as Ollama and ChromaDB drew attention as examples of expanding attack surface, while supply chain risk and AI-assisted "vibe coding" were cited as factors likely to introduce additional security flaws into rapidly deployed AI environments.