A Silicon Valley cybersecurity startup has disclosed the development of an artificial intelligence-assisted computer worm capable of hijacking WeChat accounts via simple incoming voice calls, drawing international attention and prompting a response from the Chinese government in Beijing.
Palo Alto-based cybersecurity firm Calif revealed that its researchers utilized an AI model to uncover a remote code execution vulnerability in WeChat's VoIP stack in just two days, subsequently building a self-replicating zero-click worm dubbed "WeWorm" within an additional week.
The tool demonstrated the ability to operate across both iOS and Android operating systems by targeting users through incoming app calls, allowing attackers to seize control of an account within seconds without requiring the victim to answer or interact with their device. Once compromised, the worm could theoretically propagate through the user's contact list, posing a rapid scaling risk across the messaging platform's massive global user base.
Calif disclosed that it responsibly reported the security flaw to Tencent in July. Tencent confirmed that it investigated the issue and deployed a comprehensive server-side mitigation by late August, ensuring that all users were protected against the exploit without requiring manual application updates.
Both Tencent and cybersecurity researchers emphasized that there was no evidence the exploit had ever been weaponized by external malicious actors or that any user accounts were compromised.
Addressing the disclosure during a regular press briefing this week, Chinese Foreign Ministry spokesperson Mao Ning responded to inquiries regarding the American cybersecurity firm's claims. Mao stated that she was not yet familiar with the specific enterprise's situation, while reiterating China's consistent stance that the international community should promote artificial intelligence for the public good and actively guard against its abuse or malicious misuse. Industry analysts note that the incident serves as a stark reminder of how rapidly AI can accelerate vulnerability discovery, underscoring the urgent need for proactive digital defenses worldwide.
