SAN FRANCISCO — For roughly three months, anyone sharing their screen in a Zoom meeting was participating in something they had not agreed to: a quiet security experiment in which their device could have been taken over by anyone else in the room.
A critical vulnerability in Zoom’s screen-sharing feature, assigned the designation ZSB-26015 and already nicknamed “Zoomsday,” allowed attackers to execute arbitrary code on any device participating in a meeting where screen sharing was active. Windows, macOS, Linux, iOS, and Android users were all exposed, silently, without requiring the target to click, download, or do anything beyond joining a call. Zoom has since patched the flaw. But what the disclosure has put into sharp relief is less the existence of the bug than the speed at which it was found.
A-Security, an Israeli cybersecurity firm, discovered the vulnerability in June using publicly available AI models and fewer than 20 prompts. Omer Gull, a cofounder of the firm, put the shift plainly: “Before it would have taken a team of five people maybe six months,” he told WIRED. “Now people can reach the same results with under 20 prompts.”
The compressed timeline is the part of this story that should give enterprise IT departments pause. Screen-sharing vulnerabilities are not new. A remotely exploitable flaw in a video conferencing platform is the kind of thing security researchers have chased for years. What Zoomsday demonstrates is that the combination of AI-assisted code analysis and a focused research team can now compress a months-long discovery process into something that fits inside an afternoon.
The attack required no interaction from the target. In a meeting where screen sharing was enabled, the attacker needed only to be present. The exploit then executed code at the permission level of the target’s user account. On most consumer and enterprise devices, that means access to files, the clipboard, saved credentials, and browser sessions. There was no warning dialog, no anomalous notification, and no indication that anything had happened.
A-Security disclosed the vulnerability to Zoom through a coordinated process before publishing any details. Zoom patched the flaw and classified it as critical in its internal security bulletin system. The company has not specified how many versions of the application were affected or whether the vulnerability was exploited before A-Security identified it. The absence of that disclosure means users cannot know whether their previous calls were compromised, 9to5Mac reported.
Zoom has worked to rehabilitate its security reputation since a series of problems that surfaced during the pandemic-era explosion in its user base. The company brought in senior security leadership and overhauled its encryption architecture in subsequent years. Zoomsday does not represent a return to that era; coordinated disclosure and a prompt patch is exactly how responsible disclosure is supposed to work. It does, however, demonstrate that even a platform that has invested significantly in security infrastructure can carry a critical flaw for months without internal teams or automated scanning systems catching it first.
What gives the disclosure an additional dimension of irony: A-Security’s Gull briefed WIRED journalist Lily Newman about the vulnerability during a Microsoft Teams call. That Gull chose a rival platform to discuss a Zoom flaw reflects a professional caution that the responsible disclosure process sometimes cultivates. It also produced a detail that has circulated widely among security researchers this week.
A-Security did not specify which AI models it used, though Gull described them as publicly available. That description encompasses a range of tools, from commercial reasoning models to open-source alternatives. None of them require specialized access or significant financial investment. What they require is a security researcher who knows how to prompt them effectively. The primary bottleneck in vulnerability discovery is shifting from expertise and time to know-how and iteration.
Zoom’s user base spans government agencies, hospital systems, law firms, financial institutions, and the roughly 300 million individuals the company has reported as monthly active users. A remote code execution flaw in its core infrastructure is not equivalent to a minor UI bug. The practical instruction remains simple: update Zoom. The company’s patch has been distributed through automatic updates on most platforms. Users on managed enterprise deployments should confirm their IT administrators have pushed the fix.
The AI dimension here overlaps with a pattern building across the security landscape. Microsoft’s AI cybersecurity platform last month introduced automated vulnerability discovery tools, explicitly positioned as a way to find bugs before attackers do. AI safety testing by UK government evaluators earlier this month revealed that the same models can be turned toward malicious ends under the right conditions. Zoomsday sits adjacent to both findings: an AI-enabled discovery that compressed six months of expert work into something measured in prompts.
The FBI’s recent disclosure that a North Korean IT worker infiltrated a US federal agency established that sophisticated actors are already inside the perimeters of institutions that believe themselves protected. A flaw that let an attacker silently take over a device during any Zoom call was, until last week, also inside that perimeter. Responsible disclosure programs exist to close that gap. Whether the timeline for finding the next critical vulnerability shrinks further is a question the industry has not yet been forced to answer at scale. It probably will be soon.
Related Posts
