AI-Powered Bug Hunt Exposed Zoom Flaw That Could Silently Hijack Devices During Calls

Researchers have identified a critical security gap in Zoom's screen-sharing feature that could permit attackers to seize control of participants' devices without detection or user interaction. The vulnerability, uncovered through AI-assisted security testing, highlights how automation is rapidly lowering the technical barriers to finding and weaponizing software flaws.

Security researchers at the firm A Security disclosed the bugs on Tuesday after discovering them in early June. The attack surface centered on Zoom's real-time annotation protocol—the behind-the-scenes mechanism that enables collaborative markup during screen shares. Any call participant, including the host, was susceptible to a silent takeover attempt that would leave no trace.

How AI Changed the Discovery Timeline#

The finding exemplifies a troubling shift in the cybersecurity landscape. A Security's analysis, powered by publicly available AI models, required fewer than 20 prompts to locate the vulnerabilities and develop a working proof-of-concept. According to Omer Gull, a cofounder of A Security, the same discovery through traditional manual methods would have demanded roughly six months of work from a specialist team.

"The democratization of these capabilities is what's dangerous," Gull explained. "The barrier to entry is dropping rapidly."

Why Annotation Features Became a Target#

The researchers deliberately focused their AI systems on the annotation subsystem—a relatively obscure, convoluted function within Zoom's codebase. Both human and machine-learning bug hunters recognize that complicated, overlooked features often harbor security weaknesses. In proprietary closed-source software like Zoom, components that don't receive the same public scrutiny face heightened risk, even in products from established vendors that perform rigorous code review.

The Threat Landscape#

The danger lies partly in the implicit trust surrounding Zoom calls. Joining a video conference is a gesture of access; millions use the platform daily for business meetings, webinars, and personal communication. An attacker exploiting this vulnerability could silently commandeer a participant's computer—potentially stealing credentials and pivoting into an organization's broader network.

"If I'm an attacker, I can be on a call with someone from a company, take control of their computer and their credentials, and then use them to move laterally in the enterprise," Yossi Torati, another A Security cofounder, told WIRED.