AI Tools Fall at Pwn2Own: LiteLLM and OpenAI Codex Hacked — AI Gateways Are Now Prime Targets

For years, Pwn2Own — run by Trend Micro's Zero Day Initiative (ZDI) — was synonymous with browsers, phones and cars. At Pwn2Own Ireland 2026, which opened in Cork on October 6, AI infrastructure took part of the stage: the target list now includes LLM proxies and coding agents.

What happened on day one

• LiteLLM: Taisic Yun of Xint chained an improper input validation bug with code injection to get a reverse shell, earning $40,000. Team Out of Bounds also succeeded, but two of their four bugs were already known, so the entry was scored as a collision worth $15,000.
• OpenAI Codex: Ikotas Labs compromised OpenAI's cloud-based coding agent with a single argument-injection bug for $40,000.
• Oracle Autonomous AI Database: the VinSOC team earned another $40,000 with a five-bug chain.
• Day-one total: 32 zero-days and $388,500 in awards.

Why it matters

LiteLLM is a widely used open-source proxy that gives applications access to dozens of model providers through one OpenAI-compatible interface. By design, a gateway like this concentrates every provider's API keys, prompt traffic and often company data in one place — so when it is compromised, the blast radius is not limited to a single app. The Codex case shows a different risk: in an agent that can run commands, even a single argument passed to it can become attack surface.

Details of the bugs have not been published. Under Pwn2Own rules, vendors have 90 days to ship fixes, and so far there is no report of exploitation in the wild.

Four steps for enterprises

• Keep your AI gateway off the open internet: expose the admin UI and proxy endpoints only on internal networks or behind authentication.
• Constrain the keys: store provider API keys in a secrets manager, narrow their scopes and spend limits, and rotate them regularly.
• Sandbox your agents: run coding agents in isolated sandboxes with minimal network and file permissions.
• Track the patches: add open-source AI components to your dependency inventory and apply security updates quickly as the 90-day window runs out.

Where remot fits

As an orchestration layer, remot also sits at the point where all model traffic flows, so the Pwn2Own results are a reminder for us too. remot keeps provider keys away from applications, checks every request against identity and permissions, masks personal data before it reaches a model, and logs every call. Protecting the gateway itself matters as much as protecting the models behind it.