In brief
- A security researcher found and exploited Zoom flaws using fewer than 20 AI prompts.
- The bugs affected Zoom’s annotation tool and could let an attacker run code on another participant’s device.
- Zoom fixed the vulnerabilities before they were publicly disclosed.
AI is making it faster and easier to find serious security flaws. Now, a researcher says he used publicly available models to find vulnerabilities in the video chat platform Zoom and build a working attack in less than 24 hours.
Calling it ‘Zoomsday’ in a report published Tuesday, Israeli cybersecurity firm A Security said a researcher used fewer than 20 AI prompts to uncover flaws in Zoom’s annotation tool that could let someone in a meeting take control of another participant’s device without any action from the victim.
“Once the nefarious code is running on the victim's device, the threat actor can quietly steal personal data, switch on the microphone or camera to spy on the target, or install other malicious software,” A Security wrote. “In a large call, that's a room full of targets from a single message, with no safe seat in it.”
According to A Security, the attack was tested on Zoom’s apps for Windows, macOS, Linux, Android, and iOS. The firm called it “nation-state-grade,” arguing that building such an exploit once required specialists, months of work, and a large budget.
The flaws are tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415. CVEs are public identifiers for security vulnerabilities.
“Exploits like this one are weapons. Governments regulate their export. Criminal organizations pay millions for them,” they wrote. “Acquiring one has always required nation-state infrastructure, elite teams, and months of work.”
A Security said the exploit also enables attackers to either join or host a meeting, target any participant, and take over their machine with “no required action from the victim and no visual cue indicating the compromise.”
“It worked in both directions: a compromised presenter could reach every participant, and any participant could reach the presenter,” they wrote.
A Security said it reported the first flaw to Zoom on June 10, two days after discovering it. Zoom released fixes between June 22 and July 20, but users still needed to update because its server-side safeguard could not filter malicious messages in end-to-end encrypted meetings.
“As shared on our Zoom Security Bulletin page, we’ve already resolved this issue," a Zoom spokesperson told Decrypt. "We always recommend users keep up to date with the latest version of Zoom so that they’re taking advantage of our latest features and updates."
The report comes as AI tools are being used across the tech industry to uncover bugs, including 271 vulnerabilities in Mozilla Firefox in April and flaws in the Zcash network in May. At the same time, AI models from OpenAI, Anthropic, and Meta have escaped containment and hacked other companies’ systems.