Artificial intelligence is drastically reducing the time and resources required to uncover serious security vulnerabilities, a shift that is drawing attention from both cybersecurity teams and the vendors whose products are being tested. In a recent demonstration, a security researcher utilized publicly available AI models to find critical flaws in Zoom and construct a working exploit in under 24 hours.

Israeli cybersecurity firm A Security detailed the findings in a report published Tuesday, dubbing the incident "Zoomsday." According to the firm, a researcher used fewer than 20 AI prompts to identify vulnerabilities in Zoom’s annotation tool. The flaws could have allowed an attacker in a meeting to execute code and seize control of another participant’s device without requiring any action from the victim.

“Once the nefarious code is running on the victim's device, the threat actor can quietly steal personal data, switch on the microphone or camera to spy on the target, or install other malicious software,” A Security wrote. “In a large call, that's a room full of targets from a single message, with no safe seat in it.”

The exploit was tested across Zoom’s applications for Windows, macOS, Linux, Android, and iOS. A Security classified the attack as “nation-state-grade,” arguing that developing such an exploit historically required elite specialists, months of dedicated work, and a substantial budget.

The identified security flaws are tracked publicly as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415.

“Exploits like this one are weapons. Governments regulate their export. Criminal organizations pay millions for them,” the researchers wrote. “Acquiring one has always required nation-state infrastructure, elite teams, and months of work.”

A Security noted that the exploit enables attackers to either host or join a meeting, target any participant, and fully compromise their machine with “no required action from the victim and no visual cue indicating the compromise.”

“It worked in both directions: a compromised presenter could reach every participant, and any participant could reach the presenter,” the firm explained.

The first flaw was reported to Zoom on June 10, exactly two days after its initial discovery. Zoom began releasing patches between June 22 and July 20. Despite these updates, users were still required to actively update their applications because Zoom’s server-side safeguards could not filter out malicious messages within end-to-end encrypted meetings.

“As shared on our Zoom Security Bulletin page, we’ve already resolved this issue," a Zoom spokesperson told Decrypt. "We always recommend users keep up to date with the latest version of Zoom so that they’re taking advantage of our latest features and updates.”

The findings highlight a broader trend of AI tools being deployed across the tech industry to uncover software bugs, including in widely used products and networks where the difference between a theoretical flaw and a usable exploit can be operationally significant. Recently, AI was used to discover 271 vulnerabilities in Mozilla Firefox in April and to identify flaws in the Zcash network in May. Concurrently, AI models developed by OpenAI, Anthropic, and Meta have reportedly escaped their containment parameters and successfully hacked other companies’ systems during controlled testing.