An AI agent cracked Zoom in a day. The patch can't fix what changed.

On Tuesday, Zoom shipped a fix for a vulnerability that let an attacker run code on every device in a meeting. The exploit worked silently, needed no action from victims, and showed no sign that anything was wrong. The security researchers who found it did not spend months on the problem. They spent a day, using fewer than 20 prompts on widely available AI models.

That detail, reported by Wired, is the part that matters more than the patch itself. It is a before-and-after marker for the offensive security economy: the difference between work that a state sponsor measures in months and work a single researcher measures in hours. It is the same divide an overview of AI agents in cybersecurity describes.

What the exploit actually did

The flaw sat in Zoom's annotation feature, the tool that lets meeting participants draw on a shared screen. An attacker who joined or hosted a meeting could run malicious code on victims' machines: steal data, turn on the camera or microphone, install malware. The attack required nothing from the victim and left no visual trace, according to the researchers at A Security.

The fix Zoom issued on Tuesday covers the app across Windows, macOS, Linux, Android, and iOS.

"Elite teams, months of effort"

Idan Levcovich, a vulnerability researcher at A Security, put the change in stark terms in the team's blog post.

"Producing a working exploit against it has always been nation-state work: elite teams, months of effort, budgets that governments regulate as weapons. [A Security] did it in a single day, with an AI agent and models anyone can access today."

Take the claim at face value and the implication lands hard. If a handful of prompts aimed at public models can reproduce what used to require regulated capabilities, then the barrier that kept this kind of attack in the hands of a few has mostly fallen. The constraint was never that the ideas were secret. The constraint was the time and skill required to turn them into working code.

The new math of vulnerability discovery

Security teams have spent years defending against a threat model that assumes a long runway: a bug is disclosed, a patch ships, and the interval in between is where the damage happens. AI agents compress that runway. When an agent can prototype an exploit in an afternoon, the gap between disclosure and exploitation shrinks toward zero, and the pressure moves to the speed of patching. That pressure is visible in Microsoft's plan to pack more AI-discovered fixes into Patch Tuesday.

There is a second, quieter consequence. The researchers who found this bug are the ones who disclosed it. But nothing about the workflow they describe is exclusive to researchers acting in good faith. The same public models, pointed at the same feature, are available to whoever gets there first, and the first fully AI-run ransomware attack, found by Sysdig, shows what that looks like in the wild.

This is an open question rather than a settled doom: how many similar flaws are being found daily by AI agents inside organizations that will never disclose them? The Zoom case gives a sense of the lower bound.

What stays true after the patch

Zoom's fix closes this particular hole, and users on all affected platforms should update. But the structural change is not something a patch can address. The speed at which a critical, silent, no-interaction exploit was produced is now part of the environment. Defense is already trying to match that tempo: Microsoft is building Project Perception around red, blue, and green AI agents. Enterprise security teams that still plan for attacks to arrive on human timelines are planning for a world that no longer exists.