WeWorm: the first zero-click worm for WeChat calls, written with the help of AI

The Calif Research team has published a demonstration of WeWorm — by its own account, the first zero-click worm to spread through calls in the WeChat messenger on two platforms at once, iOS and Android. A quote from the researchers' statement was shared on his blog by Simon Willison.

The key feature of the attack is that the victim doesn't have to do anything at all. According to the developers, there's no need to answer the call or interact with the phone in any way. Even if the person does pick up, they won't hear a sound — and the exploit fires all the same.

The role of artificial intelligence

The most remarkable thing about this story isn't the mere existence of the vulnerability, but how little time it took to exploit it. As Calif Research tells it, working together with AI, their team found the bug and wrote the first remote code execution (RCE) exploit in roughly two days. Another week went into turning the exploit into a full-fledged self-propagating worm.

The researchers pointedly stress the contrast with the recent past: a worm of this scale used to be a task that took a large team months. Now, by their estimate, AI is capable of doing most of the work on its own. What's left to the human, as they put it, is judgment — understanding exactly what to attack and how to run the testing safely.

Why this matters

Behind the measured wording lies a troubling signal for the entire information security industry. The point isn't that AI has invented a fundamentally new class of attack, but that it drastically lowers the barrier to entry and shortens the timelines. If the chain of “find a vulnerability — a working RCE — a worm” used to be the preserve of well-staffed teams with plenty of time on their hands, now, if Calif Research is to be believed, the same result is achievable by a small group in a matter of days.

It should be noted that only the researchers' own statements and the demonstration are publicly available; the material offers no independent verification of the details, nor any technical specifics of the WeChat vulnerability. Even so, the very framing of the question deserves attention: the tools that speed up the work of defenders just as readily speed up the work of attackers.

Source: Simon Willison