AI found Zoom flaw in under 20 prompts; Zoom patches device takeover bug

The discovery highlights a fundamental shift in how software vulnerabilities are found and exploited. Traditionally, uncovering flaws in complex closed-source applications like Zoom required extensive human expertise, time, and resources—a team of five researchers might spend six months refining their approach. Zoom's annotation protocol is precisely the kind of target human hunters would focus on: it is convoluted and obscure, features that researchers have learned often harbor overlooked bugs. Closed-source software is particularly susceptible because it lacks the benefit of public review that can catch mistakes in esoteric components.

What makes this disclosure sobering is the democratization of this capability. By using fewer than 20 prompts to publicly available AI models, the researchers achieved in hours what once required months of specialized work. This dramatic reduction in the "barrier to entry" means that vulnerability discovery is no longer confined to well-resourced security teams. The risk is amplified by Zoom's position of trust: users do not typically perceive it as a threat vector, making it an especially attractive target for attackers wielding AI-powered tools.