Zoom Patches Device-Takeover Flaw Found With AI in Under 20 Prompts
Zoom has patched a vulnerability in its screen-sharing annotation feature that allowed an attacker to execute malicious code on a participant's device during an active meeting, with no interaction required from the victim and no visible indication of compromise. The fix, issued on a Tuesday, covers the Zoom client across Windows, macOS, Linux, Android, and iOS. The vulnerability is documented in Zoom's security bulletin ZSB-26015 (Zoom Security Bulletin).
Security researchers at the firm A Security discovered the flaw using fewer than 20 prompts directed at publicly available AI models. Idan Levcovich, a vulnerability researcher at A Security, detailed the findings in a blog post. According to Levcovich, producing a working exploit for this class of vulnerability had previously been nation-state-level work. A Security completed it in a single day using an AI agent and publicly accessible models (The Verge).
The exploit targeted Zoom's annotation feature, which lets users draw on their screen while sharing it with other meeting participants. By joining or hosting a meeting, an attacker could leverage the flaw to run arbitrary code on victims' devices. The consequences were broad: data exfiltration, covert activation of the camera or microphone, and malware installation were all within the attack's reach. A Security reported that the attack required no action from victims and produced no visual cue signaling the compromise (A Security).
Wired reported A Security's findings earlier, before The Verge's coverage on August 11, 2026 (The Verge).
The cross-platform scope is worth noting. A vulnerability that spans all five major desktop and mobile operating systems means the attack surface covered essentially every Zoom endpoint in use. Annotation is enabled by default in many meeting configurations, particularly in education and collaborative workflows, which broadens the practical exposure window between discovery and patch adoption.
Levcovich's claim about the difficulty reduction deserves scrutiny on its own terms. If producing this exploit previously required nation-state resources and AI assistance compressed that to a single day, the relevant comparison is not to historical vulnerability research in general but to this specific attack class. The annotation feature processes shared graphical input across untrusted meeting participants; flaws in that pipeline would typically require deep reverse engineering of the client's rendering and IPC layers. An AI agent orchestrating that workflow with under 20 prompts suggests the models contributed meaningful coverage of the discovery and exploitation pipeline, not just a brute-force fuzzing loop.
The broader context here is not that AI has suddenly made vulnerability research trivial. It is that the cost of finding certain classes of exploitable flaws has dropped measurably, and the barrier has shifted from specialized expertise to the ability to effectively direct an AI agent. For a platform with Zoom's install base, that cost reduction matters even for a single flaw, because the population of actors capable of finding the next one has expanded. Security teams that have historically calibrated patch-management urgency against the likelihood of independent discovery may need to recalibrate. The window between vulnerability existence and exploitation has always been the critical metric, and AI-assisted discovery compresses it.
Zoom acted to patch the flaw, and the bulletin is now public. The practical question for enterprises is patch adoption speed across managed and BYOD endpoints, particularly mobile devices where update cadence is often slower and less controlled. The annotation feature can also be disabled administratively as a mitigation for organizations that cannot deploy the patch immediately.
What this incident makes possible, in the most constructive sense, is a clearer empirical baseline. A Security has provided a concrete data point: under 20 prompts, one day, publicly available models, a working exploit for a real vulnerability in widely deployed software. That is a more useful input for threat modeling than abstract concerns about AI and cybersecurity. Security teams can work with numbers, even preliminary ones. Vague alarm cannot.
