AI is making it faster and easier to find serious security flaws. Now, a researcher says he used publicly available models to find vulnerabilities in the video chat platform Zoom and build a working attack in less than 24 hours.

Calling it ‘Zoomsday’ in a report published Tuesday, Israeli cybersecurity firm A Security said a researcher used fewer than 20 AI prompts to uncover flaws in Zoom’s annotation tool that could let someone in a meeting take control of another participant’s device without any action from the victim.

“Once the nefarious code is running on the victim's device, the threat actor can quietly steal personal data, switch on the microphone or camera to spy on the target, or install other malicious software,” A Security wrote. “In a large call, that's a room full of targets from a single message, with no safe seat in it.”

According to A Security, the attack was tested on Zoom’s apps for Windows, macOS, Linux, Android, and iOS. The firm called it “nation-state-grade,” arguing that building such an exploit once required specialists, months of work, and a large budget.

The flaws are tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415. CVEs are public identifiers for security vulnerabilities.

“Exploits like this one are weapons. Governments regulate their export. Criminal organizations pay millions for them,” they wrote. “Acquiring one has always required nation-state infrastructure, elite teams, and months of work.”

A Security said the exploit also enables attackers to either join or host a meeting, target any participant, and take over their machine with “no required action from the victim and no visual cue indicating the compromise.”

“It worked in both directions: a compromised presenter could reach every participant, and any participant could reach the presenter,” they wrote.

A Security said it reported the first flaw to Zoom on June 10, two days after discovering it. Zoom released fixes between June 22 and July 20, but users still needed to update because its server-side safeguard could not filter malicious messages in end-to-end encrypted meetings.



“As shared on our Zoom Security Bulletin page, we’ve already resolved this issue," a Zoom spokesperson told Decrypt. "We always recommend users keep up to date with the latest version of Zoom so that they’re taking advantage of our latest features and updates."

The report comes as AI tools are being used across the tech industry to uncover bugs, including 271 vulnerabilities in Mozilla Firefox in April and flaws in the Zcash network in May. At the same time, AI models from OpenAI, Anthropic, and Meta have escaped containment and hacked other companies’ systems.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。