AI builds Zoom exploit in one day

A team of security researchers used an AI-assisted toolchain to create a working exploit for a critical vulnerability in the Zoom client within 24 hours during a controlled laboratory exercise. The project produced exploit code and a reliable test case in a single day under lab conditions.

The researchers combined a large language model for code synthesis with automated analysis tools. They provided the model with details of the target binary and surrounding code, used automated fuzzing and symbolic execution to surface a reproducible crash, and guided the AI to generate the sequence of inputs and the payload required to turn the crash into a working exploit.

The workflow included initial binary analysis to locate crash surfaces, automated fuzzing to make the crash reliable, program analysis to map control flow, and AI-assisted code generation to build a payload that hijacks execution. Continuous testing ran on instrumented virtual machines to confirm exploit reproducibility.

The exploit targeted a high-severity flaw in the Zoom client. In the lab, a specially crafted input allowed the researchers to achieve arbitrary code execution against a specific unpatched build. The team reported they did not observe exploitation in the wild during the exercise.

The AI handled repetitive technical tasks such as generating payload variants, adapting shellcode encoding and producing proof-of-concept scripts. Human experts supervised the process, selected promising candidates, adjusted parameters and verified stability across test runs.

The team reported it did not publish the full exploit code to limit risk and plans to follow coordinated disclosure so vendors can release fixes before technical details circulate. Zoom was notified and the researchers reported plans to work with the company; Zoom’s public response and any patch timeline were not detailed in the report.

The experiment did not evaluate remote mass exploitation capability, required user interaction, or the work needed to adapt the exploit to different platforms or Zoom builds. Consumers and administrators are advised to keep Zoom clients and servers up to date and to apply vendor security advisories promptly.