AI tool hijacks Zoom devices in seconds, threatening 1.5 billion users

A public AI tool discovered a critical flaw in Zoom’s screen‑sharing feature that could let attackers hijack a device in under 20 prompts, researchers said on Tuesday. The flaw was uncovered by an open‑source language model that rapidly tested Zoom’s chat and screen‑share functions. The discovery was announced by a security research group that monitors AI‑generated threats.

Zoom has faced security scrutiny after earlier bugs exposed data leaks and remote code execution vulnerabilities. The new flaw comes as the platform remains the most widely used video‑conferencing service for remote work, education, and virtual events. With more than 1.5 billion users worldwide, any weakness that can be triggered from a simple chat message raises concerns about the safety of virtual meetings.

The vulnerability works by injecting malicious commands through Zoom’s chat interface, allowing an attacker to run code on the host’s machine without the user’s knowledge. The AI model was able to craft a sequence of prompts that caused Zoom to execute an unauthorized script, effectively taking control of the device. The researchers noted that the exploit requires only a few seconds of interaction, and it does not rely on any user‑initiated file downloads or external links.

Zoom has acknowledged the issue and is working on a patch that will be rolled out in the coming weeks. Security experts advise users to keep their Zoom client updated, use two‑factor authentication, and be cautious about accepting screen‑share requests from unknown participants. The incident highlights the growing intersection of AI and cybersecurity, where machine learning tools can both uncover and potentially create new attack vectors.