98 zero-day flaws found at TrendAI hacking contest

Security researchers found 98 zero-day vulnerabilities during TrendAI's Pwn2Own Ireland hacking competition, which paid more than USD $1.2 million in bounties.

The vulnerabilities affected a wide range of widely used technologies, including mobile phones, smart home devices, wellness devices, printers, messaging apps, AI infrastructure and AI coding agents. The flaws have been disclosed to vendors so they can be fixed before attackers exploit them.

That total was up from 73 zero-day vulnerabilities found at the same event a year earlier, pointing to a broader attack surface as consumer devices and AI tools become more embedded in daily life and business use. The results also highlight risks for organisations across Australia and New Zealand as employees and consumers rely on connected hardware and software that may contain previously unknown weaknesses.

Mick McCluney, Field CTO at TrendAI ANZ, said the findings reflected the scale of unseen risk in common technologies.

"Finding 98 zero-day vulnerabilities in three days shows how much undiscovered risk sits inside the devices and AI tools Australians and New Zealanders use every day. The phone in your pocket, the printer on the office network and the AI coding agent a developer installed last week can form part of an organisation's attack surface," McCluney said.

TrendAI's Zero Day Initiative works with software and hardware vendors by providing technical details of flaws before they are made public. The model is designed to give vendors time to issue fixes and reduce the period in which cyber criminals can exploit newly discovered vulnerabilities before defenders are aware of them.

TrendAI said customers of its Vision One platform are protected through virtual patching an average of 115 days before the rest of the industry. It linked that claim to the coordinated disclosure process run through the Zero Day Initiative, under which vendors receive vulnerability information before any public release.

McCluney said early visibility can shorten the time between discovery and protection.

"Visibility into these vulnerabilities helps us protect Australian and New Zealand organisations through virtual patching, an average of 115 days ahead of the rest of the industry. As the attack surface grows with AI, zero-day threats will continue to rise, reinforcing the importance of visibility over devices and AI systems connected to your environment, and closing the gap between a flaw being disclosed and patched," he said.

Devices in scope

Pwn2Own has become one of the best-known hacking contests in the security industry, with researchers attempting to compromise selected devices and applications under controlled conditions. The Ireland event focused on familiar consumer and office technologies, including phones, printers, smart home hubs and wearable devices.

TrendAI argued that the significance of those demonstrations lies in how closely the products resemble systems used in workplaces. A flaw in a consumer phone or networked printer can share the same underlying weakness as software and hardware used in eCommerce, banking, healthcare and critical infrastructure.

Dustin Childs, Head of Threat Awareness at TrendAI's Zero Day Initiative, said the event's value extended beyond awarding bounties to researchers.

"The vulnerabilities discovered at Pwn2Own are sent to vendors so they can patch them quickly. The lasting value of an event like this is what defenders learn. Every exploit chain demonstrated on stage teaches us something new about how modern systems break, and those lessons go directly into how we train our own research capability to discover, validate and remediate the next one faster. As AI tools and infrastructure continue to become central to business functions, staying ahead of vulnerabilities will be as critical as ever," Childs said.

Competition results

Among the standout results, Ikotas Labs was named Master of Pwn after chaining multiple issues together to exploit the Google Pixel 10 near the end of the three-day contest. Xint, which finished second, demonstrated a remote exploit of the same handset through a single bug collision.

Interrupt Labs also drew attention after taking control of a Lexmark CX532adwe printer and using its screen to run the video game Doom. While theatrical, the stunt underscored how devices often treated as routine office equipment can become an entry point for attackers if left exposed or unpatched.

TrendAI said its research suggests some vendors are becoming slower or less consistent in addressing reported software vulnerabilities. That trend has raised concern across the cybersecurity sector because delayed patching can leave known weaknesses open long after technical details have been shared privately.

The latest results also show how AI systems are being drawn into the same vulnerability discovery process long applied to operating systems, browsers and network devices. As AI coding agents and supporting infrastructure move into mainstream business environments, security researchers are beginning to test them in the same way as other connected technologies.

For businesses in Australia and New Zealand, the findings add to pressure on security teams to maintain visibility across both traditional endpoints and emerging AI tools. The breadth of the flaws found at the competition suggests attack surfaces now extend well beyond laptops and servers to include personal devices, office peripherals and software agents installed with little central oversight.