Notes · ·
AI Helped Turn a WeChat Bug Into a Zero-Click Worm in About a Week
Joshua MorrisSimon Willison highlighted some security research from Calif this morning that is one of the more alarming demonstrations I have seen yet of what AI is doing to the economics of offensive security.
Researchers at Calif found a memory corruption bug in WeChat's voice calling system and turned it into a zero-click worm capable of spreading between iPhones and Android phones. A compromised account could call one of its friends, take over that person's WeChat account while their phone was still ringing, and then use the newly compromised account to continue spreading. The person receiving the call didn't need to answer it. They didn't need to click a link, open a file, approve a prompt, or really do anything at all. Their phone just had to ring.
That is bad enough. The part that really caught my attention, though, is how quickly the researchers were able to build it. Calif says its team worked with AI to find the vulnerability and write the first remote code execution exploit in about two days. Building the working worm took another week. They say work at this scale would previously have required a larger team working for months. That is a pretty significant change in the threat model.
A missed call could become the next attacker
The exploit took advantage of a memory corruption vulnerability in WeChat's VoIP stack. Calif is withholding the technical details for now while the broader attack surface is being addressed, which seems like a very good idea. What they have demonstrated publicly is already enough to understand why this was dangerous.
The attacker needed to be on the victim's WeChat friend list, so this was not a worm that could simply start dialing random numbers across the Internet. But once one person's account was compromised, that restriction became much less useful. The worm could make calls from the compromised person's own account to people who already trusted it.
Calif demonstrated the chain with three phones. An Android phone called an iPhone and compromised its WeChat account while it was ringing. The compromised iPhone then called another Android phone and compromised that one too. The second victim had become the next attacker.
That is exactly the property that makes worms frightening. The attacker doesn't have to manually compromise every target. Each successful compromise creates another place from which the attack can continue. In this case, declining the incoming call quickly enough would stop that particular attempt. Ignoring the call would not, and answering it would not either. Calif says the exploit still worked silently even if the victim picked up.
A call from someone you know could appear on your phone, ring for a few seconds, and by the time you wondered why they never said anything, your account could already be compromised. That is an extraordinary attack surface.
The account compromise was already serious
There is an important distinction here because some of the coverage makes this sound like the worm automatically owned the entire phone. By itself, the exploit gave the researchers control of the victim's WeChat account. They could read and send messages, make calls, and act as that user. Calif says it could be chained with other Android and iOS vulnerabilities the company has found to gain broader control of a device. Those are different things, and the distinction matters.
Taking over a WeChat account is still extremely serious, particularly for an application that functions as messaging, payments, identity, social networking, and everyday infrastructure for an enormous number of people. WeChat reports more than 1.4 billion monthly active users. But the most interesting thing to me isn't whether this particular exploit stopped at the application boundary. It is how quickly the researchers crossed from finding a bug to having a working cross-platform worm.
AI is collapsing the time between vulnerability and exploit
Security research has always involved a strange race. Someone discovers a vulnerability. Researchers figure out whether it is exploitable. Someone develops a reliable exploit. Defenders understand the problem, build a patch, distribute it, and hope users install it before somebody weaponizes the vulnerability at scale. Every one of those stages takes time, and AI appears to be shortening some of them dramatically.
Calif says its people still provided the judgment about what to investigate, how to test it, and how to work safely. The AI did not wander off one afternoon and independently release a WeChat worm. There were experienced security researchers driving the process and, as Calif's CEO told The New York Times, they still had to "babysit" the work. That qualification doesn't make me feel much better.
The important question is not whether today's models can independently perform every step of sophisticated exploit development. The question is how much more productive they make someone who already knows what they are doing. If a small group with AI can accomplish in days what previously required a larger group working for months, the number of people capable of conducting advanced vulnerability research grows substantially. That is wonderful when they are finding the vulnerability and reporting it to Tencent. It is considerably less wonderful when they aren't.
We have been talking about this moment for a while
For years one of the arguments around increasingly capable coding models has been that they would eventually become good enough at vulnerability research to change cybersecurity in both directions. Defenders could use them to find bugs faster. Attackers could use them to find bugs faster. Both statements can be true at the same time.
What feels different about WeWorm is that it isn't another benchmark showing that a model can solve some percentage of security challenges. Calif found a real vulnerability in one of the world's largest messaging applications, developed working exploits for both major mobile platforms, and built a worm demonstrating how it could propagate. Then they disclosed it to Tencent.
Tencent released Android 8.0.77 and iOS 8.0.76 on August 21 and later deployed a server-side mitigation. Calif confirmed on August 28 that its exploit no longer worked for users. Tencent told The New York Times it had no reason to believe the vulnerability had been exploited in the wild. That is about as good an outcome as you could hope for from research like this. The researchers found it before somebody used it maliciously, the vendor fixed it, and the technical details that would make reproducing the attack easier are being withheld while additional work continues.
But the vulnerability was already there. AI didn't create it. AI helped people find and weaponize it much faster. That distinction is probably where the real security problem is.
We may have an enormous backlog of exploitable mistakes
Modern software contains decades of accumulated code, libraries, parsers, protocol implementations, media codecs, device drivers, and network stacks. Some of it has been reviewed extensively. Some of it has simply survived long enough that everyone assumes the dangerous bugs must have been found already. That assumption is becoming harder to make.
We are giving increasingly capable models the ability to inspect enormous amounts of code, generate hypotheses, write test cases, build fuzzers, interpret crashes, inspect assembly, modify exploits, and repeatedly try again without getting tired. There is probably a tremendous amount of vulnerable software sitting in the world waiting for somebody sufficiently motivated to examine it.
Historically, the cost of doing that examination provided at least a little protection. Highly skilled security researchers are scarce, and their time is expensive. AI is reducing that cost. The obvious defensive response is to use exactly the same capability against our own software before attackers do. If AI can compress months of offensive security work into days, then vendors need to be using it to compress years of security backlog too. That could ultimately make software considerably safer. Getting from here to there may be uncomfortable.
The phone ringing is what makes this feel real
I keep coming back to that part of the demonstration. We are trained to look for the dangerous interaction. Don't click the suspicious link. Don't open the attachment. Don't install the application. Don't approve the unexpected login. There was no dangerous interaction here. The phone rang, and that was enough. A small security team says AI helped them go from discovering that possibility to building a worm around it in a little more than a week.
Simon pulled out the sentence from Calif's report that I think makes this notable beyond WeChat:
"A worm at this scale used to be the kind of thing that took a larger team months."
That is the thing I am going to remember about this. The vulnerability has been fixed. This particular worm is not loose on the Internet, and Tencent says it has no evidence that users were compromised. The capability that helped build it isn't going away. We spent decades accumulating software under one set of assumptions about how expensive it was to find and weaponize its mistakes. Those assumptions may have just changed.