Anyone in a Zoom meeting could have silently hijacked another participant's computer, no whiteboard clicks required.
Security firm A.Security found two remote-code-execution bugs in Zoom Workplace, patched in version 7.0.6 (7.1.5 on the fast-track branch). Both lived in the library that handles Zoom's annotation feature, which runs constantly in the background even if nobody ever opens the whiteboard. The flaw was a classic buffer overrun: the code trusted a size field sent by another participant instead of checking it, so an attacker could pad a message with extra data and get it executed as code. Once in, the attacker couldn't get kernel-level access, since Zoom doesn't run as admin, but grabbing a user's data and setting up persistent access afterward is trivial from there. Zoom shipped a fix after A.Security's report, and current versions are unaffected.
The bigger story is how it was found. A.Security says its team built a working exploit for closed-source, proprietary software using just 20 prompts to an AI agent, first ranking attack surfaces on a decompiled Android build, then targeting the network protocol directly. That matters because most AI-assisted bug hunting so far has leaned on open-source code or documented protocols. Zoom is neither, and it still fell in days. With roughly 220 million monthly users and 56 percent of the conferencing market, the exploitable surface here was about as large as it gets.
A.Security's line about the weapons-grade-budget era of hacking being over is also, conveniently, a pitch for A.Security. But the underlying math checks out: the 90-day responsible-disclosure clock was built for a world where finding bugs like this took a team of specialists months, not an afternoon.