AI-Powered Vulnerability Hunting Uncovers Critical Zoom Screen-Sharing Flaws

Security researchers have exposed a critical vulnerability in Zoom's screen-sharing feature that could allow attackers to seize control of users' devices silently and without any sign of an attack. The flaw, discovered by the security firm A Security, affects Zoom across all major operating systems and demonstrates a troubling shift in how easily advanced hacking techniques can now be developed.

How the Attack Works#

The vulnerability resides in the protocol that powers Zoom's real-time annotation tool during screen sharing. Anyone participating in a call—whether as a host or attendee—could have been exposed to exploitation without their knowledge or interaction.

AI's Role in Rapid Discovery#

The researchers uncovered the flaw in early June using off-the-shelf artificial intelligence models, requiring fewer than 20 prompts to both identify the vulnerabilities and develop a working proof of concept. This speed represents a dramatic departure from traditional vulnerability research, where finding and weaponizing similar flaws once demanded months of work by specialized teams.

"What is dangerous is the democratization of these capabilities," A Security cofounder Omer Gull explained to WIRED. "[The] barrier to entry is dropping rapidly. Before it would have taken a team of five people maybe six months with a lot of refining and iteration to find this. Now people can reach the same results with under 20 prompts."

Why Zoom Was Vulnerable#

AI-driven bug hunting systems, like human researchers, tend to focus on convoluted and less-documented functions as likely sources of overlooked flaws. Zoom's annotation feature—a niche, complex component of a proprietary platform—fit this profile. While large companies conduct extensive code review, closed-source systems lack the benefit of public scrutiny, making intricate but underused features particularly susceptible to oversights.

Zoom's Response#

Zoom published a security advisory and has already begun rolling out patches to address the flaws across Windows, macOS, Linux, iOS, and Android devices.

Read more: A Security's disclosure