Lily Hay Newman (via Ben Lovejoy):

As AI models gain advanced capabilities to find vulnerabilities in software, develop ways to exploit them, and even carry out autonomous hacking sprees, researchers offered a sobering new example on Tuesday, disclosing vulnerabilities in the video conferencing platform Zoom that could have been exploited to take over targets’ devices. Anyone on a call that involved screen sharing, whether participants or the host, would have been vulnerable to a silent attack that could be carried out with no indication and no interaction from the victim.

Researchers from the digital defense firm A Security say the bug was discovered in early June using publicly available AI models, and that it took fewer than 20 prompts to uncover the vulnerabilities and create a working attack. Zoom issued a security advisory on Tuesday, including details about fixes the company has already begun rolling out to address the flaws, which affected devices running all operating systems that Zoom supports—Windows, macOS, Linux, iOS, and Android.

[…]

The vulnerabilities were specifically in the protocol used to facilitate real-time annotation during screen sharing.

I don’t understand how it could take over an iOS device when Zoom’s iOS screen sharing feature only allows observation, not control.

Previously:

• macOS 26.6.1
• Zoom Security Improvements
• Every Zoom Security and Privacy Flaw So Far