A set of Zoom vulnerabilities has put a sharp spotlight on how quickly AI-assisted bug hunting is changing software security. Researchers from the digital defense firm A Security said the flaws could have been used to take over devices during Zoom calls that involved screen sharing, without warning signs and without requiring the victim to click or approve anything.
The bugs have now been patched, according to the source article, with Zoom issuing fixes on both the server side and the client side. But the disclosure matters beyond a single product update: it shows how trusted collaboration tools can become high-value targets when vulnerability discovery becomes faster and easier.
What the Zoom bug could have allowed
The vulnerabilities affected the protocol Zoom used to support real-time annotation during screen sharing. That matters because annotation is not a headline feature for most users, but it is part of the live interaction layer that makes screen sharing useful in meetings, webinars, and collaborative sessions.
According to the researchers, anyone on a call involving screen sharing could have been exposed. That included both hosts and participants. The attack could have been silent, and the victim would not have needed to interact with the attacker beyond being present on the call.
The reported impact was severe: a successful exploit could have allowed attackers to take over target devices. The affected platforms included every operating system Zoom supports: Windows, macOS, Linux, iOS, and Android.
Zoom issued a security advisory on Tuesday and had already begun rolling out fixes. Those fixes included updates for Zoom’s own servers as well as patches for applications running on customer devices.
Why screen sharing created trust risk
Video calls often feel routine. People join them for work, school, events, webinars, and personal conversations. That familiarity lowers suspicion, especially when the meeting itself appears normal.
The researchers emphasized that this trust is part of what made the vulnerability scenario alarming. In their view, simply getting a target onto a Zoom call could have been enough to create a path toward compromise if the bug had been in an attacker’s hands.
A Security cofounder Yossi Torati described the risk to WIRED in direct terms: “If you just get on a Zoom with us, we can take over your device.” He also warned that the worst case could extend into an enterprise if an attacker used control of one computer and its credentials to move laterally through a company.
That point is important for organizations because collaboration platforms are not isolated from broader security posture. A meeting app may sit on a device that also has access to email, internal systems, files, identity tools, and credentials. A compromise at the meeting layer can therefore become a starting point for wider intrusion.
How AI changed the discovery process
A Security said the bug was discovered in early June using publicly available AI models. The researchers also said it took fewer than 20 prompts to uncover the vulnerabilities and create a working attack.
That is the part of the disclosure with the biggest long-term implication. The source article frames the case as a concrete example of AI models gaining advanced capabilities in vulnerability discovery, exploit development, and even autonomous hacking activity.
A Security cofounder Omer Gull told WIRED that the key concern is the “democratization of these capabilities.” He said the barrier to entry is dropping rapidly, comparing the newer process with work that previously could have taken a team of five people maybe six months with substantial refining and iteration.
The researchers’ systems focused on the real-time annotation protocol because complex and obscure features often hide overlooked bugs. The article notes that this is especially relevant in proprietary, closed source software, where public review is not available in the same way it can be for open source code.
Why obscure features deserve more scrutiny
The Zoom case is a reminder that security risk does not always live in the most visible feature. Screen sharing itself is widely understood, but real-time annotation is a deeper component that many users may barely think about. Yet it still handles live data between people inside a call.
That kind of feature can be difficult to reason about because it has to support interaction, timing, permissions, device differences, and network behavior. The more complicated the feature, the more room there may be for mistakes that are hard to spot during ordinary use.
The source article says an established company like Zoom presumably performs extensive code review and vetting. Even so, the researchers argued that obscure and complex functions can remain more likely to contain mistakes when they lack the benefit of broad public review.
For security teams, the lesson is not simply to distrust video conferencing. It is to treat collaboration software as part of the attack surface, especially when it supports live sharing, annotation, remote interaction, or workflows that users instinctively trust.
The broader security race
The bugs are patched, but the larger issue remains. As AI bug hunting spreads, defenders and attackers are both moving faster. Tools that can help researchers find and explain vulnerabilities can also lower the effort needed for malicious actors to search for weak spots.
That creates pressure on software vendors to review overlooked components with the same seriousness as core product features. It also raises the importance of fast patch deployment, because a vulnerability in a trusted app can affect users across personal devices, company systems, and public-facing events.
The Zoom disclosure shows how the security contest is shifting. The danger is not only that software contains bugs. It is that the time needed to find, understand, and weaponize those bugs may be shrinking.