Zoom patches critical flaw exposed with under 20 AI prompts

Zoom faced a critical security crisis this week after researchers at A Security uncovered a major vulnerability in the platform's annotation feature—a capability that lets users draw on their screen while sharing it with meeting participants. By exploiting this feature, an attacker could join or host a meeting and execute malicious code directly on victims' devices, potentially stealing data, activating cameras or microphones, or installing malware. The attack was particularly dangerous because it required no action from the victim and produced no visual warning of compromise.

What made the discovery extraordinary was how it was made. Idan Levcovich, a vulnerability researcher at A Security, noted in the company's blog post that "producing a working exploit against it has always been nation-state work: elite teams, months of effort, budgets that governments regulate as weapons." Yet A Security achieved a working exploit in a single day using fewer than 20 prompts on publicly available AI models—tools anyone can access. This dramatic shift in the cost and timeline for discovering sophisticated vulnerabilities reflects the growing capability of large language models and AI agents to reason through security patterns and code vulnerabilities.

Zoom addressed the flaw on Tuesday by issuing a patch across Windows, macOS, Linux, Android, and iOS. The breadth and speed of the fix underscored the company's recognition of the threat's severity. For users, the incident serves as a concrete reminder that the technical barrier to discovering and exploiting previously nation-state-level vulnerabilities has eroded, and that keeping software up to date is no longer a convenience but an immediate security imperative.