Zoom Bug Let Anyone Hijack Devices via Screen Share; AI Found It in Under 20 Prompts

On Tuesday, researchers from A Security publicly disclosed vulnerabilities in Zoom's video conferencing platform that could have allowed any participant in a screen-sharing session to silently take over another person's device. The flaws affected all operating systems Zoom supports: Windows, macOS, Linux, iOS, and Android. Critically, an attacker would need no special interaction from or indication to the victim; joining the call itself would be sufficient to launch a successful exploit.

The vulnerabilities were discovered in early June using only publicly available AI models and required fewer than 20 prompts to uncover and weaponize. The specific target was Zoom's annotation protocol—the real-time system that enables drawing and markup during screen sharing. A Security researchers deliberately focused on this component because they recognized, as human security researchers do, that convoluted and obscure functions in proprietary, closed-source software are statistically more likely to contain overlooked vulnerabilities. While an established company like Zoom presumably conducts extensive code review, the lack of public, open-source scrutiny leaves esoteric features more exposed.

Zoom issued a security advisory on Tuesday disclosing the flaws and detailing fixes the company had already begun rolling out via both server-side and client-side patches. The company did not respond to WIRED's requests for comment. However, A Security's cofounders emphasized the severity of what had been possible. Yossi Torati stated: "If you just get on a Zoom with us, we can take over your device. The worst case scenario is that we can take over an enterprise just by having this vulnerability in our hands. If I'm an attacker I can be on a call with someone from a company, take control of their computer and their credentials, and then use them to move laterally in the enterprise." Omer Gull highlighted the structural shift: "What is interesting for us and what we believe is dangerous is the democratization of these capabilities—the barrier to entry is dropping rapidly. Before it would have taken a team of five people maybe six months with a lot of refining and iteration to find this. Now people can reach the same results with under 20 prompts."