AI Crafts Critical Zoom Exploit in One Day

AI Accelerates Discovery of Critical Zoom Vulnerabilities

Artificial intelligence is rapidly streamlining the process of identifying significant security flaws. In a stark demonstration, a researcher has reportedly leveraged publicly available AI models to discover vulnerabilities within the video conferencing platform Zoom and construct a functional exploit in under 24 hours.

Dubbed “Zoomsday” in a report released Tuesday by Israeli cybersecurity firm A Security, the researcher utilized fewer than 20 AI prompts to uncover weaknesses in Zoom’s annotation tool. These flaws could allow an individual within a meeting to gain control of another participant’s device without any action from the victim.

“Once the malicious code is executing on the victim’s device, the threat actor can stealthily exfiltrate personal data, activate the microphone or camera for surveillance, or deploy additional malware,” A Security stated. “In a large conference call, this translates to a room full of potential targets accessible from a single message, leaving no one safe.”

According to A Security, the attack was successfully tested across Zoom’s applications for Windows, macOS, Linux, Android, and iOS. The firm characterized the exploit as “nation-state-grade,” emphasizing that developing such a tool previously demanded specialized expertise, extensive time, and substantial financial investment.

The identified vulnerabilities are cataloged as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415. CVEs serve as public identifiers for security weaknesses.

“Exploits of this nature are essentially weapons. Governments control their export, and criminal organizations are willing to pay millions for them,” the report noted. “Acquiring such capabilities has historically necessitated nation-state infrastructure, elite teams, and months of dedicated work.”

A Security further detailed that the exploit allows attackers to join or host meetings, target any participant, and compromise their machine with “no required action from the victim and no visual cue indicating the compromise.”

“The attack proved effective in both directions: a compromised presenter could reach every participant, and any participant could reach the presenter,” the firm explained.

A Security reported the initial flaw to Zoom on June 10, two days after its discovery. Zoom subsequently released patches between June 22 and July 20. However, users were still required to update their software, as Zoom’s server-side safeguards were insufficient to filter malicious messages within end-to-end encrypted meetings.

“As detailed on our Zoom Security Bulletin page, we have already addressed this issue,” a Zoom spokesperson told Decrypt. “We consistently advise users to maintain the latest version of Zoom to benefit from our most recent features and updates.”

This report emerges as AI tools are increasingly employed across the technology sector for bug detection, including the identification of 271 vulnerabilities in Mozilla Firefox in April and flaws within the Zcash network in May. Concurrently, AI models from OpenAI, Anthropic, and Meta have demonstrated the ability to bypass security measures and compromise other companies’ systems.