AI Agent Discovers Zoom Zero-Click RCE

The technical core of Zoomsday is not a single overflow but a chain of small design gaps stacked on top of each other. At the bottom sits a missing bounds check inside Zoom's annotation parser deserialization code, the function that reads markup drawn on a shared screen. The parser trusted attacker-controlled length and count fields from the wire and copied that data straight into four fixed 128-byte buffers, a classic recipe for a stack overflow ^[1].

What makes this chain notable, though, is the protocol-level trick that let the bug reach any participant with zero clicks. Zoom's annotation channel is built on an asymmetry: participants send annotations to the meeting's sharer, and the sharer can only send "ack" messages back. A Security's researchers found that the sharer could place a full, malicious annotation object inside that ack message, and the participant's client would deserialize it exactly as if it were a normal incoming annotation, because the relay never validated which seat a message actually came from ^[2]. That single oversight turned a screen-annotation feature almost nobody thinks about into a channel for stack buffer overflow (CVE-2026-53413), heap over-read (CVE-2026-53414), and, via a separate flaw in autoshape metadata handling credited to researcher Lidor Elias, a write-what-where primitive (CVE-2026-53415) that gave attackers reliable control over code execution rather than just a crash.

The part of this story generating the most attention is not the bug itself but how fast it was found. Senior Vulnerability Researcher Idan Levcovich told SC Media the team used Anthropic's Claude Opus 4.7 and 4.8, publicly available frontier models with no special access ^[2], paired with an IDA Pro MCP plugin for static reverse engineering and a Frida MCP setup for dynamic tracing ^[3]. That combination let the model-driven workflow rank 3,762 functions across 70 libraries before dynamic tracing zeroed in on the annotation feature as the highest-value target ^[1].

Cofounder Omer Gull put the resulting time compression in blunt terms: "Before it would have taken a team of five people maybe six months. Now people can reach the same results with under 20 prompts" ^[2]. A Security's own disclosure goes further, arguing the entire capability tier has shifted: "This class of capability would previously have only been available to nation-state threat actors, but the model requiring elite teams, months of effort, and weapons-grade budgets has collapsed" ^[1]. Whatever one makes of the framing, the underlying claim, fewer than 20 prompts and under 24 hours from first look to working zero-click exploit, is a concrete, falsifiable data point about how far AI-assisted vulnerability research has come, not a hypothetical. The story also moved fast off the research blog itself: mainstream outlets like WIRED, infosec trade press like The Hacker News, and independent security-news accounts all picked up the AI-discovery angle the same day, uniformly framing it as a call to patch now.

It is worth being precise about the actual public risk window here, because it is easy to read "AI found a zero-click RCE" as breaking news about an active threat. It is not. A Security reported the chain to Zoom on June 10, and Zoom had a client-side fix live by June 22, twelve days later, followed by a server-side mitigation on July 15 and a further client-side patch on July 20 closing the write-what-where CVE. The full set of patched builds was published on August 11, and only then, on August 12, did A Security go public with the technical writeup ^[1]. Zoom's own statement reflects that sequencing: "As shared on our Zoom Security Bulletin page, we've already resolved this issue. We always recommend users keep up to date with the latest version of Zoom" ^[5].

That two-month gap between private disclosure and public writeup is the responsible-disclosure model working as intended, and it is also the source of the dual-use tension underneath this story: the same AI tooling that let A Security compress months of manual reverse engineering into a day could, in principle, let a less scrupulous actor do the same thing against an unpatched target. In this case the defenders got there first and used the head start correctly. The practical takeaway for any organization running Zoom is less dramatic than the headline and more actionable: this was never an unpatched zero-day loose in the wild by the time it became public, it is a check-your-version problem. That same conclusion held in the practitioner community: reaction on r/cybersecurity and r/blueteamsec read as matter-of-fact rather than alarmed, essentially "noted, patch and move on," and one commenter pointed out that the fix had reportedly been live for about three weeks before the public writeup, the same head-start point made above.

The severity rating and the installed base are what turn a clever bug chain into a genuine enterprise risk story. Zoom rated the lead vulnerability, CVE-2026-53413, CVSS 8.3, high severity, reflecting that a successful attacker needed no credentials, no user interaction, and no warning displayed to the victim ^[6]. A Security's disclosure spells out what that access is worth to an attacker in practice: "Once the nefarious code is running on the victim's device, the threat actor can quietly steal personal data, switch on the microphone or camera to spy on the target, or install other malicious software" ^[4].

Scale is the other half of the risk calculation. A Security's own writeup notes that Zoom is used by roughly 70% of Fortune 100 companies, meaning that before the final patch tranche landed on August 11, a working, silent, zero-click RCE existed against the meeting software of most of the largest companies in the world ^[1]. That combination, undetectable compromise plus near-universal enterprise deployment, is exactly the profile that used to justify nation-state-level investment in a single exploit chain. That it was reproduced here in under a day is the number security teams should actually be tracking, not just the patch version they need to confirm.