Device Takeover via Screen Sharing in Zoom — an AI Found the Flaw in 20 Prompts

A Security has disclosed a set of vulnerabilities in the Zoom video-conferencing platform that allowed an attacker to silently take control of a victim's device. Anyone on a call with screen sharing was at risk — guests as well as the host. The attack ran quietly, with no telltale signs and without a single action on the victim's part.

The problem lay in the protocol responsible for real-time annotations during screen sharing. According to the researchers, this was precisely the feature their AI bug-hunting systems targeted: like human specialists, they are trained on the idea that convoluted, low-visibility components are more likely to harbor overlooked flaws. That is especially true of proprietary closed-source code: even a major company like Zoom conducts reviews, but without a public open audit, exotic yet complex features such as annotations are more apt to retain defects.

The vulnerabilities affected every platform Zoom supports — Windows, macOS, Linux, iOS, and Android. On Tuesday, Zoom released a security bulletin and has already begun rolling out fixes both on the server side and in its client applications.

The real story isn't the bug — it's how easy it was to find

The most disturbing thing here isn't the individual hole but how it was found. The vulnerability was discovered back in early June using publicly available AI models, and identifying the problem and building a working exploit took fewer than twenty prompts.

“What's interesting and, in our view, dangerous is the democratization of capabilities like this: the barrier to entry is dropping fast,” said A Security co-founder Omer Gall. In the past, he said, a find like this might have taken a five-person team roughly six months of painstaking work. Now the same result is achievable in a couple of dozen prompts. And Zoom is a valuable target precisely because it is trusted by default and not seen as a source of threat.

The fallout is easy to picture. “If you just hop into a Zoom with us, we can take over your device,” said another co-founder, Yossi Torati (the conversation, ironically, was taking place over Microsoft Teams). The worst case is the compromise of an entire company: the attacker gains control of an employee's machine and credentials, then moves deeper into the corporate network.

The very act of joining a call is already a gesture of trust, and because video communication is ubiquitous in both personal and work settings — and is used for webinars and semi-public events on top of that — people tend to let their guard down. Security has long been called a game of cat and mouse, but as AI-driven vulnerability hunting spreads, that dance is turning into a genuine race.

Source: Ars Technica