Products and services, research and development, and security competition results.
20 ARTICLES / NEWEST FIRST
We assess internet-facing services such as Web applications, APIs, and administrative interfaces through AI-assisted source review and hands-on attack validation, delivering a report in principle within five business days.
Ikotas Labs won Pwn2Own Ireland 2026 after exploiting the Google Pixel 10, Samsung Galaxy S26, OpenAI Codex, and Oracle Autonomous AI Database, earning $361,000 and 42.5 Master of Pwn points.
We are launching Web application vulnerability assessment and forensic support services powered by SUGI, our fully local LLM product. Integrated with our AI agent, SUGI delivers performance close to that of frontier models, with no data ever leaving your infrastructure — suitable even for environments handling confidential data.
Japanese members personally recruited by our CEO won DEF CON 34 CTF Finals and also earned five more placements at Village CTFs and other contests, including additional 1st places.
Our specialized LLM agent reached arbitrary code execution in all 10 trials across two V8 vulnerabilities.
BunkyoWesterns, a team including our members, took 1st place worldwide at CODEGATE 2026 CTF Finals (General track) held in South Korea, earning a first-place prize of ₩50,000,000.
Our member discovered an information disclosure vulnerability in the Privacy component of Firefox for Android and reported it to Mozilla.
We are launching Ikotas Exploit Development Training, a practical training program centered on LLM-assisted exploit development. This hands-on program is tailored to each participant and covers the major targets researchers work against from an attacker's perspective, walking through the process from vulnerability analysis to constructing exploits that actually succeed.
Our team discovered multiple memory safety vulnerabilities that lead to arbitrary code execution in tools shipped with the TeX Live typesetting system, and reported them to the developer under coordinated disclosure. We demonstrated that arbitrary code execution is achievable on the official distribution binaries simply by compiling a malicious document.
We are launching Ikotas AI×Security Training, a practical training program for putting AI agents to work in real security operations. It is a hands-on series covering AI utilization across security workflows from an attacker's perspective.
BunkyoWesterns, a team including our members, took 1st place worldwide at Midnight Sun CTF 2026 Finals held in Sweden.
Our member discovered a local privilege escalation 0-day on the latest Linux kernel, chaining two kernel bugs, and reported it to the vendor.
Our member discovered vulnerabilities in Firefox's DOM: Bindings (WebIDL) and Popup Blocker components and reported them to Mozilla.
Our member competed on day 3 of Pwn2Own Berlin 2026 and successfully exploited OpenAI Codex, an AI coding agent.
Our member competed on day 1 of Pwn2Own Berlin 2026 and successfully exploited NVIDIA Megatron Bridge and LiteLLM.
Our member discovered a new privilege escalation variant of the Dirty Frag family in the Linux kernel's RxRPC RxGK security class.
Our member discovered vulnerabilities in Firefox's Networking: Cookies and Debugger components and reported them to Mozilla.
Our member discovered a privilege escalation vulnerability in Firefox's Netmonitor component and reported it to Mozilla.
Our team won the general category of the Ministry of Defense Cyber Contest 2026.
Our members took 1st and 2nd place at the Singapore AI Safety Red Teaming Challenge 2026.