My First Pwn2Own

Last week I got the chance to compete in Pwn2Own Ireland 2026. I ran a chain against the Oracle Autonomous AI Database and it succeeded, and our team won 40,000 USD and 4 Master of Pwn points. This was my first Pwn2Own, and honestly the whole thing still feels crazy to me even a week after the event. I wanted to write down my experience in this blog post and tell my side of the story.

The initial chain

For Pwn2Own this year, they listed the Oracle Autonomous AI Database as 1 of the targets. I had already spent months working on this target beforehand for Pwn2Own Berlin 2026 (but couldn’t register for it in time) so I had prior experience with the target already. I spent a few more months on this target before the event. A lot of that time was spent on manual reverse engineering, setting up fuzzers, and blasting AI on the target. It was a slow grind with lots of dead ends, and I was not sure I would have anything to show at all for a good while.

We ended up finding 2 vulnerabilities that we planned to use for Pwn2Own Ireland and we signed up for an entry at the Oracle AI DB target.

The downfall

And then that chain got killed just days before the competition. The chain was clean, I had practiced it, and I was feeling pretty confident about it. Then one of the bugs of the chain got patched. I lost a vital piece of the exploit chain at the worst possible moment, right as I was about to travel out to Ireland with nothing to fall back on. When I saw the updated version and saw that my chain got killed, my stomach felt like it physically dropped. I was panicking internally. I wasn’t sure if my teammates was aware of my panic or not.

I can’t really recall what my thoughts are back then. All I remember is that I have to figure out a way to get this to work before the competition. There was no time to feel sorry about it. I just had to find another way through.

Finding a new path

I got to work on my flight to Ireland. It was around 16 hours of flying and transit, and I spent most of those time working on this chain, finding a way. I couldn’t relax. I tried to rest but there’s stil something in the back of my mind telling me that it’s now or never. I kept trying, ideas after ideas. When I landed I still did not have it, so I kept going on the bus ride from Dublin down to Cork (which was 3 hours long), watching the Irish countryside go by out of the corner of my eye while I stared at a terminal.

It was a race against the clock, only 1 day left before the competition and I was going first. And finally, boom, a new chain. 5 bugs. Full pre-auth RCE.

Landing in Ireland

This was my first time visiting Ireland. Cork itself has a very relaxing and quiet vibe in a way that felt very different from home. There is something strange about traveling that far from home to an entirely different continent for the first time only to run your Python program for a few minutes. The Python program that traveled across the world, carrying months of sweat and tears, and the whole thing comes down to just a few minutes in a room. I wanted to enjoy being there and mostly I just wanted it to be over so I could relax and finally breathe again.

Waiting for my turn

My attempt was scheduled for the afternoon of the first day, which meant I spent the whole morning and lunch being nervous and anxious before it was my turn. I watched other researchers go up and run their attempts, some of them landing clean and some of them running out of time.

The win

When it was finally my turn, I set up my script, checked the configs, waited for them to start the clock, and ran the chain. I don’t really remember a lot of the details of those minutes, just that I was watching for the reverse shell to pop and trying not to think about how many people were watching me. Then it landed, the ZDI team confirmed it, and I felt this huge weight coming off my shoulder after barely sleeping and quietly assuming it might all fall apart. The joy didn’t come until I had a chance to sit down and let everything that happened within the last few days to actually sink in.

After Pwn2Own

Looking back, I think the parts that I’ll remember is not just the win, but also the day where everything had gone wrong and I had to rebuild the whole thing from a plane seat, and the fact that it came together anyway. I also remember Mat Powell (one of the ZDI staffs at Pwn2Own Ireland this year) casually talking, helping me calm down before I start my attempt. For a first Pwn2Own, I could not have asked for a better story to come home with.

Cork, Ireland

I really enjoyed Cork, it’s a very beautiful and very relaxing city. It’s my first time traveling to Europe, I’d seen pictures of Ireland before but seeing it with my own eyes really invokes a different kind of feeling, the one that can’t really be described with words. The people there are quite friendly and nice, I really enjoyed all the small talks with strangers.