Researchers exploit major Zoom flaw using AI, forcing emergency patch

Zoom has released a security patch addressing a critical vulnerability that researchers discovered with the help of AI tools, marking a troubling milestone in how quickly serious exploits can now be developed.

The vulnerability and its scope#

The flaw existed within Zoom's annotation feature, which lets users mark up shared screens during meetings. Attackers could weaponize this capability to inject malicious code onto every participant's device in a call. The exploitation worked without requiring any action from victims and left no warning signs of compromise, making detection nearly impossible. The vulnerability affected Zoom installations across all major platforms—Windows, macOS, Linux, Android, and iOS.

What the exploit enabled#

Once an attacker gained access through the annotation flaw, they could execute several dangerous actions: stealing data from devices, activating cameras and microphones without permission, and deploying malware. The attack worked whether the threat actor joined or hosted the meeting.

How AI accelerated discovery#

Researchers at A Security uncovered the working exploit in a single day using fewer than 20 prompts sent to publicly available AI models. This speed represents a dramatic shift in cybersecurity timelines. "Producing a working exploit against it has always been nation-state work: elite teams, months of effort, budgets that governments regulate as weapons," noted vulnerability researcher Idan Levcovich in a blog post detailing the discovery. The team's ability to crack it rapidly with consumer-grade AI tools underscores how accessible sophisticated hacking has become.

Response and implications#

Zoom released the patch on Tuesday, addressing the flaw across all affected platforms. The incident highlights a growing gap between security researchers' ability to identify vulnerabilities and the speed at which malicious actors—now armed with AI—might weaponize them.