Under 24 hours and fewer than 20 prompts. That was the entire cost of finding a zero-click remote code execution flaw in Zoom, according to the cybersecurity firm A Security, which pulled it off using AI models that are available to the public today.
No frontier system locked behind a waitlist. No gated enterprise tier with a six-figure contract stapled to it. Just off-the-shelf tools, aimed carefully by researchers who understood what they were hunting for.
The bug itself is about as bad as bugs get
The defining trait of a zero-click flaw is that the victim makes no mistake at all. Nothing is clicked, downloaded, or opened. You sit in a meeting, a colleague shares their screen, and that alone is the entire attack surface.
The weakness sits in Zoom’s annotation tool — the feature that lets you draw arrows over someone else’s slides. In a blog post, A Security noted that Zoom’s client “automatically parses whatever it receives” whenever annotation is switched on, which opens the door for an attacker to deliver a “specially crafted message to corrupt the receiving client’s memory and run code on it.”
And it gets worse from there. The app’s underlying protocol establishes a direct channel between each viewer and the person sharing, meaning attendees on a call could be targeted one by one.
End-to-end encryption didn’t save you
By all accounts the flaw sat in every build of Zoom across every operating system. It also worked on calls running with end-to-end encryption enabled — the very toggle people reach for because they assume it’s the secure option.
A fix has shipped. But patches only protect the people who actually apply them, and Zoom is precisely the sort of software that sits open and un-restarted for months at a stretch. Check which version you’re on.
The discovery method is the actual story
By A Security’s account, the models both spotted and exploited the flaw inside 20 prompts. Human researchers were steering throughout, telling them where to look — so this isn’t a case of AI cracking software on its own. Genuine expertise supplied the aim.
The thing is, aiming was always the cheap half of the job and finding was always the expensive half. That balance has now shifted.
The frontier labs have been selling a different story
For a while now, every major AI lab has been advertising just how formidable its flagship models are — and citing exactly that power as the reason access must stay restricted. Too dangerous for the wrong hands, goes the pitch.
Yet the tools already sitting on everyone’s laptop are remaking the cyber industry regardless. The distance between that marketing and what’s actually shipping to the public is worth dwelling on.
At the Black Hat cybersecurity conference in Las Vegas last week, officials from the United States and the United Kingdom cautioned that vulnerabilities are now being uncovered faster than defenders can patch them.
What to do about it
Update Zoom, and do it today rather than at some point. It’s the single concrete step on offer here, and it seals this particular hole.
The wider situation is messier. Nobody was ever promised safety, but the pool of people capable of turning up a zero-click RCE in widely deployed software has just grown far past the specialist ranks — and most of us are carrying more risk than we’d guess.