CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Chroma

product · product:chroma

Coverage
1
first 2026-05-17 → last 2026-10-21
Latest activity
2026-05-17
Pwn2Own Berlin 2026 paid $1,298,250 for 47 zero-days; DEVCORE won as Exchange, ESXi and AI coding agents fell
Peak priority
routine
1 routine
Targets
technology
sectors: technology
Sources cited
7
4 hosts

Defender insights

What each entry about Chroma tells a defender to do, newest first.

2026-05-17ROUTINEPwn2Own Berlin 2026 paid $1,298,250 for 47 zero-days; DEVCORE won as Exchange, ESXi and AI coding agents fell

Exposure

Story timeline

  1. 2026-05-17Pwn2Own Berlin 2026 results: 47 zero-days and $1,298,250 awarded, DEVCORE Master of Pwn, AI coding agents and inference tools exploited
    researchPwn2Own Berlin 2026 paid $1,298,250 for 47 zero-days; DEVCORE won as Exchange, ESXi and AI coding agents fell

Hunting pivots

Releases covered
Chroma
Tags
ai-abusevulnerabilitieszero-day
ATT&CK techniques (3 across 2 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Privilege EscalationExploitation for Privilege Escalation · Escape to Host

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-17/pwn2own-berlin-2026-master-of-pwn-outcomes-the-new-ai-agents · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-05-17/pwn2own-berlin-2026-master-of-pwn-outcomes-the-new-ai-agents · ATT&CK page ↗

T1611Escape to Host×1

Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.

Evidence: 2026-05-17/pwn2own-berlin-2026-master-of-pwn-outcomes-the-new-ai-agents · ATT&CK page ↗

Entries about Chroma (1)

2026-05-17 · view entry permalink →

ROUTINEupdatedNATOA1

Pwn2Own Berlin 2026 results: 47 zero-days and $1,298,250 awarded, DEVCORE Master of Pwn, AI coding agents and inference tools exploited

Pwn2Own Berlin 2026, ZDI's second Berlin contest after the inaugural 2025 event, ran at OffensiveCon from 14 to 16 May (Zero Day Initiative, 2026-03-12) (BleepingComputer, 2026-05-15). For 2026 ZDI split its AI category into AI Databases, Coding Agents, Local Inferences and NVIDIA (Zero Day Initiative, 2026-03-12). Targets ran fully patched in their default configurations (Zero Day Initiative, contest rules), and vendors have 90 days to patch after the zero-days are disclosed at the contest (BleepingComputer, 2026-05-15). Before it began, Hackread wrote that it had reportedly run out of space and that some researchers turned away were releasing their findings instead (Hackread, 2026-05-12).

The final totals were $1,298,250 for 47 unique zero-days; DEVCORE won Master of Pwn with 50.5 points and $505,000, ahead of STARLabs SG (25 points, $242,500) and Out Of Bounds (12.75 points, $95,750) (Zero Day Initiative, 2026-05-16).

Enterprise and platform targets. Orange Tsai of DEVCORE chained four logic bugs for a Microsoft Edge sandbox escape ($175,000) on Day One (Zero Day Initiative, 2026-05-14) and three bugs for remote code execution as SYSTEM on Microsoft Exchange ($200,000) on Day Two (Zero Day Initiative, 2026-05-15); neither ZDI nor BleepingComputer states whether the chain needs authentication. splitline of DEVCORE chained two bugs against Microsoft SharePoint ($100,000), and Nguyen Hoang Thach of STARLabs SG used a memory corruption bug against VMware ESXi with the cross-tenant code execution add-on ($200,000) (Zero Day Initiative, 2026-05-16), an entry that runs code from a guest on the hypervisor (Zero Day Initiative, contest rules). Windows 11 and Red Hat Enterprise Linux for Workstations fell to privilege escalations (improper access control, heap overflow, use-after-free, integer overflow and race-condition bugs), and NV Container Toolkit to chompie ($50,000) and to 0xDACA and Noam Trobishi with a use-after-free ($25,000) (Zero Day Initiative, 2026-05-14) (Zero Day Initiative, 2026-05-15) (Zero Day Initiative, 2026-05-16).

AI targets. OpenAI Codex fell to Compass Security with a single CWE-150 bug ($40,000), while a Doyensec entry used a bug previously known to the vendor and a Viettel attempt failed (Zero Day Initiative, 2026-05-14); Summoning Team ($20,000) (Zero Day Initiative, 2026-05-15) and Satoki Tsuji of Ikotas Labs, through an external control ($20,000), also exploited it (Zero Day Initiative, 2026-05-16). Cursor fell to Viettel ($30,000) and Compass Security ($15,000) (Zero Day Initiative, 2026-05-15). LM Studio fell to STARLabs SG (five bugs) and LiteLLM to k3vg3n (three bugs), both chains including SSRF and code injection and each worth $40,000 (Zero Day Initiative, 2026-05-14); OtterSec took LM Studio with a code injection bug ($20,000) (Zero Day Initiative, 2026-05-15). Out Of Bounds took Chroma with two bugs (CWE-190, CWE-362; $20,000), and NVIDIA Megatron Bridge fell three times (Zero Day Initiative, 2026-05-14). Every Anthropic Claude Code entry, Summoning Team's Claude Desktop entry, the Ollama entry and two LiteLLM entries hit previously known bugs or collisions (Zero Day Initiative, 2026-05-14) (Zero Day Initiative, 2026-05-15) (Zero Day Initiative, 2026-05-16), and an Oracle Autonomous AI Database attempt failed (Zero Day Initiative, 2026-05-14).

bringing the final totals to $1,298,250 awarded for 47 unique 0-day vulnerabilities across three days of competition

Zero Day Initiative, Day Three 2026-05-16

chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning $200,000 and 20 Master of Pwn points

Zero Day Initiative, Day Two 2026-05-15

used a single CWE-150 bug to exploit OpenAI Codex, earning $40,000 and 4 Master of Pwn points

Zero Day Initiative, Day One 2026-05-14

This year, we’re expanding this and splitting it into multiple different categories: AI Databases, Coding Agents, Local Inferences, and a separate category for NVIDIA products.

Zero Day Initiative, contest announcement 2026-03-12

Vendors have 90 days to patch their software and hardware after the zero-days are disclosed at Pwn2Own.

BleepingComputer 2026-05-15
Correctionrun 2026-10-21T1149Z-auditactionsaffected_productsbodyclassificationdeep_divedeep_dive_categoryevidenceheadlinekindpriorityregionssectorssourcessummarytagstechniquestitle

ZDI and BleepingComputer report the Exchange result as three chained bugs giving remote code execution as SYSTEM, and neither says the chain works without authentication (Zero Day Initiative, 2026-05-15) (BleepingComputer, 2026-05-15). ZDI ran no "AI Agents" category: for 2026 it split its existing AI category into AI Databases, Coding Agents, Local Inferences and NVIDIA (Zero Day Initiative, 2026-03-12), and not every AI target fell: an Oracle Autonomous AI Database attempt failed, while Chroma was a two-bug success rather than a collision (Zero Day Initiative, 2026-05-14). The pages report results only; they carry no patch forecast, no attack-pattern analysis of the AI targets and no hardening advice. The release of findings by researchers turned away from the contest was reported by Hackread before the contest as the researchers' own action, not ZDI's (Hackread, 2026-05-12). Vendors have 90 days to patch after the zero-days are disclosed at the contest (BleepingComputer, 2026-05-15), and the NV Container Toolkit researcher is Noam Trobishi (Zero Day Initiative, 2026-05-15).

research17 May 05:00Zmulti-sourceOpen finding →
Sources: Zero Day Initiative, Day Three · Zero Day Initiative, Day Two · Zero Day Initiative, Day One · BleepingComputer · Hackread · Zero Day Initiative, contest announcement · Zero Day Initiative, contest rules

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Research1

Source distribution

  • zerodayinitiative.com3 (43%)
  • thezdi.com2 (29%)
  • bleepingcomputer.com1 (14%)
  • hackread.com1 (14%)
All cited sources (7)