How a $0 AI Model Found a Zoom Zero-Day That Lets Anyone Hijack Devices

The exploit needed only twenty prompts.

In early June, researchers at A Security fed a handful of instructions into a publicly available AI model and got back something that should not have been easy to produce: a working exploit for a Zoom vulnerability that let an attacker silently seize control of any device on a video call.

By mid-August, the findings were made public. Zoom released a security advisory on August 11, confirming the flaw and shipping patches for every operating system it supports—Windows, macOS, Linux, iOS, and Android. The software giant did not respond to WIRED’s repeated requests for comment, according to the publication’s reporting.

What makes this story worth sitting with is not the bug itself, important as it is, but the speed and accessibility of the discovery process. Twenty prompts. A single AI model. No custom tooling, no team of specialists grinding through code for months. The exploit worked passively: a victim did not need to click anything, did not need to acknowledge any prompt, did not need to see that anything was wrong at all.

Why annotation? The blind spot in the Zoom stack.

The vulnerability lived in the protocol powering Zoom’s real-time annotation feature—the one that lets participants scribble on a shared screen during a meeting. The AI-driven bug-finding system, which learns from patterns in how human researchers approach testing, focused its attention here. Complex features that sit beneath the visible surface of an application tend to accumulate overlooked code paths. Zoom’s annotation system fit that profile precisely.

This is a familiar dynamic in software security. Even well-funded companies running rigorous review cycles can miss edge cases in functionality that feels mundane enough to deprioritize. Annotations are invisible to most users most of the time. The code that drives them touches real-time rendering, network protocols, and privilege boundaries—and it does so without the same visibility as core video or audio pathways. A security researcher might audit the camera stack or the encryption layer; an AI system trained on attack patterns would also notice that annotation is a function that accepts untrusted input from any participant and pushes it onto a shared canvas.

The annotation bug turned out to be worse than a typical input-validation flaw. It crossed into arbitrary code execution.

The cost of finding a zero-day just dropped to near zero.

“We find it interesting, and at the same time dangerous, that capabilities like these are becoming widely accessible and the barriers to entry are falling rapidly,” Omer Gul, A Security’s co-founder, told WIRED before the disclosure. He went on: what previously required a team of five researchers iterating for roughly six months can now be achieved with fewer than twenty prompts.

That arithmetic matters more than any individual vulnerability.

For years, the gap between elite state-level exploit writers and casual threat actors was sustained by the sheer difficulty of finding deep software flaws. Large enterprises like Zoom invest heavily in code review, red-teaming, and internal security audits. The assumption—sometimes naive, often validated—has been that the more eyes you put on critical infrastructure, the fewer undiscovered bugs remain. The traditional model of vulnerability discovery is slow, expensive, and therefore scarce. AI turns that scarcity into abundance.

The A Security finding is a proof point that the old economics of zero-day hunting are breaking down. When a publicly available AI model can surface a full-chain exploit against a platform used by hundreds of millions of people, the assumption that enterprises are safe simply because they spend money on internal review no longer holds. AI does not replace human researchers; it amplifies their coverage, and it reaches into feature surfaces humans rarely think to probe.

Zoom’s trust deficit compounds the risk.

The particular danger of a Zoom vulnerability is not just technical—it is psychological. People walk into Zoom meetings assuming the connection itself is a sealed container. Hosts share screens with the expectation that annotations are limited to what they allow. Participants join with the expectation that their device remains theirs. This vulnerability violated all three assumptions simultaneously. An attacker needed only to add a victim to a meeting. No social engineering. No malicious link. No downloaded payload. Just presence in the call.

For enterprises, the implication is stark. Boardroom calls, client presentations, internal strategy sessions—all of them ran through a surface that could not be trusted to remain benign. The patch addresses the protocol flaw, but the lesson is broader: video-conferencing platforms must be treated the way network infrastructure is treated, with continuous scrutiny rather than periodic audits.

What happens next.

Zoom has patched both its server-side components and its client applications across all supported platforms. That is the necessary first step, and it is not trivial—covering every OS variant is harder than covering one. But the disclosure also opens a window that was already starting to crack.

Security vendors and threat intelligence firms will now be hunting for similar AI-discovered flaws in other collaborative software. The annotation protocol is not unique to Zoom—Slack, Microsoft Teams, and Google Meet all run variations of the same mechanism. If A Security’s methodology can reproduce results against Zoom with twenty prompts, the baseline expectation should be that those same models are being applied elsewhere.

The timeline matters, too. The bug was found in June, disclosed in August, patched in August. A Security chose public disclosure rather than selling the flaw on the gray market, which is a meaningful signal—but the window between discovery and patch is always the dangerous window, and as AI discovery accelerates, that window is likely to narrow further for everyone.

Enterprise security teams should treat this as a boundary condition for their posture. Video-conferencing software is not plumbing anymore. It is a privileged execution surface, and AI is making it easier than ever to find the cracks inside it.