IA · 12 August 2026 · 3 min read
Under 20 Prompts: How AI Discovered a Zero-Click Flaw Hijacking Any Device on Zoom
In brief: Security firm A Security revealed how artificial intelligence is drastically lowering the bar for offensive cybersecurity. Using publicly available AI models and fewer than 20 prompts, researchers discovered a critical flaw in Zoom's annotation feature. Now patched, the zero-click vulnerability enabled silent remote code execution on any connected device regardless of the operating system.
by Team Mocchi's
A Silent Exploit Hiding Inside Everyday Video Calls
Joining a routine virtual meeting only to have your webcam silently activated, corporate files exfiltrated, and malware installed—all without clicking a single link or downloading any file. This was the realistic threat scenario enabled by a critical zero-click vulnerability uncovered inside Zoom, the communication platform used by millions of enterprises and public institutions globally.
The security flaw resided specifically within Zoom's real-time annotation feature used during screen sharing. By exploiting this component, any meeting participant or host could execute arbitrary code remotely on other connected devices. As detailed in a report by WIRED, the exploit required zero victim interaction and left no visible indicators on the target screen.
The vulnerability impacted Zoom's entire client ecosystem across supported operating systems, including Windows, macOS, Linux, iOS, and Android.
From Nation-State Warfare to Automated Prompting
What makes this discovery a watershed moment for the technology sector is not merely the flaw's severity, but the mechanism used to find it. The vulnerability was not unearthed by a nation-state cyber team after months of reverse-engineering closed-source binaries, but rather by an AI agent powered by publicly accessible artificial intelligence models guided by security firm A Security.
According to reporting from The Verge, researchers required fewer than 20 prompts to guide the AI model toward Zoom's most complex and proprietary code paths. Trained to emulate human bug-hunting tactics, the AI agent navigated closed-source components and generated a fully functional exploit in under twenty-four hours.
Historically, developing zero-click exploits against proprietary software demanded elite offensive engineering teams, months of labor, and multi-million-dollar budgets. The integration of specialized AI agents has compressed this timeline to a matter of hours, drastically lowering the technical barrier to entry.
The Democratization of Zero-Days and the Patching Race
A Security responsibly disclosed its findings to Zoom in June, enabling the company to develop and deploy remediation measures. Zoom has since issued server-side updates alongside client patches for desktop and mobile applications.
Nevertheless, the incident highlights a fundamental shift in offensive cybersecurity dynamics. As commercial LLMs become adept at analyzing binary structures, spotting memory corruption issues, and crafting functional payloads, vulnerability research is no longer confined to highly funded intelligence agencies or sophisticated criminal syndicates.
The public disclosure demonstrates that autonomous AI agents can be double-edged swords: while offering unprecedented speed for defensive code auditing, they simultaneously grant low-skilled actors access to nation-state grade exploitation capabilities.
Mocchi's take
The Zoom zero-click revelation makes it glaringly clear that traditional software security testing is no longer sufficient. For organizations developing custom software or embedding third-party platforms into core business workflows, the AI-driven acceleration of exploit discovery demands a shift in posture. When vulnerability vectors can be generated by AI agents in hours, defensive code reviews and patch management must achieve the same velocity. Businesses must embed continuous, AI-assisted security auditing directly into their development pipelines and maintain rigorous automated update schedules across all enterprise devices.