Ethical Hacking News
A critical vulnerability has been discovered in Zoom that could have allowed anyone on a call to hijack another participant's device. Researchers from A Security say it took fewer than 20 prompts to uncover the vulnerabilities and create a working attack, highlighting the growing concern about AI bug hunting and its potential consequences.
Researchers from A Security discovered a security vulnerability in Zoom that could have allowed anyone on a call to hijack another participant's device. The vulnerability was found in the protocol used for real-time annotation during screen sharing and took less than 20 prompts to uncover. The bug hunter AI system exploited the complexity of proprietary, closed-source software, which can contain overlooked vulnerabilities. The potential consequences include taking control of a device and its credentials to move laterally in an enterprise network. The democratization of this capability with AI bug hunting tools makes it a concerning threat, as it takes less time to find vulnerabilities than before.
WIRED has recently uncovered a shocking security vulnerability in the popular video conferencing platform Zoom that could have allowed anyone on a call to hijack another participant's device. Researchers from the digital defense firm A Security say they discovered the bug in early June using publicly available AI models, and it took fewer than 20 prompts to uncover the vulnerabilities and create a working attack.
The vulnerabilities were specifically in the protocol used to facilitate real-time annotation during screen sharing. The researchers say that their AI bug hunting systems delved into this component because, like human bug hunters, they have been trained that convoluted and obscure functions often contain overlooked vulnerabilities. This is particularly true with proprietary, closed source software. An established company like Zoom presumably does extensive code review and vetting on all components and functions, but without the benefit of public, open review, esoteric yet complex features like annotation are more likely to contain mistakes.
When A Security discovered the vulnerability, they were alarmed by the potential consequences. "If you just get on a Zoom with us, we can take over your device," Yossi Torati, cofounder of A Security, told WIRED in an interview. The worst-case scenario is that they can take over an enterprise just by having this vulnerability in their hands. If an attacker is on a call with someone from a company, they can take control of their computer and their credentials, and then use them to move laterally in the enterprise.
The democratization of these capabilities is what makes this threat so concerning. Before, it would have taken a team of five people maybe six months with a lot of refining and iteration to find this vulnerability. Now, people can reach the same results with under 20 prompts. And Zoom is an important type of target because people assume trust when using it. They don’t see it as a threat.
This revelation highlights the growing concern about AI bug hunting and its potential consequences. As AI models become more advanced, they gain capabilities to find vulnerabilities in software, develop ways to exploit them, and even carry out autonomous hacking sprees. Researchers are now racing against time to stay one step ahead of these threats.
The patches have been rolled out by Zoom to address the flaws, but researchers emphasize that it was alarming to contemplate bugs that could have been exploited to take over a target device simply by getting someone onto a Zoom call. Joining a call is in itself a gesture of trust, but given how ubiquitous video calling is in both personal and professional contexts—and given that Zoom in particular is also widely used for events and semi-public activities like webinars—people typically have their guard down when joining a Zoom.
As AI bug hunting proliferates, this delicate dance has become an all-out race. Practitioners often call security a "cat and mouse game," but the stakes are now higher than ever before. The security landscape is rapidly evolving, and it's crucial for users to be aware of these threats and take necessary precautions to protect themselves.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Silent-Threat-Lurking-in-Zoom-The-Democratization-of-Vulnerabilities-through-AI-Bug-Hunting-ehn.shtml
https://www.wired.com/story/a-zoom-screen-sharing-bug-let-anyone-take-over-other-devices-on-a-call/
Published: Tue Aug 11 08:31:00 2026 by llama3.2 3B Q4_K_M
