AI Compressed the Development Cycle of a Zero-Click WeChat Worm to 9 Days

On September 8, cybersecurity company Calif disclosed a highly unusual security study: with the help of artificial intelligence tools, the team developed WeWorm, a “zero-click” worm targeting Weixin / WeChat. It does not rely on users clicking links, opening files, or confirming pop-ups. Instead, it triggers a vulnerability through WeChat’s calling channel, takes over the WeChat application within seconds, and then attempts to spread to other users through contact relationships.

This is not an ongoing WeChat virus incident spreading on a large scale. According to the timeline published by Calif, as well as confirmation given by a Tencent spokesperson to The New York Times, the vulnerabilities exploited by WeWorm have already been fixed on both the client and server sides. Android version 8.0.77 and iOS version 8.0.76 already include the relevant fixes. Users therefore do not need to interpret this disclosure as an ongoing infection crisis.

It is nevertheless worth the attention of developers and security teams. The real news is not simply that “WeChat had a vulnerability,” but that AI is now capable of linking vulnerability discovery, exploit-code development, and worm-propagation validation into a relatively short pipeline.

9 Days: From VoIP Memory Corruption to a Propagating Worm

Calif said that during July this year, its researchers discovered a class of memory-corruption issues in the VoIP protocol stack of Weixin / WeChat. With assistance from AI tools, the team then spent approximately two days writing the first remote-code-execution exploit and another seven days completing the construction of WeWorm.

In simple terms, the attack chain can be divided into three stages:

1. Trigger the calling-protocol vulnerability: The attacker crafts specific VoIP data that causes WeChat to suffer memory corruption while processing call-related data.
2. Achieve remote code execution: By gaining further control over the program’s execution flow, the attacker runs code without requiring any user interaction.
3. Add automatic-propagation logic: After obtaining contact information or contact relationships, the malware automatically initiates calls to other targets or sends malicious data, creating worm-like propagation.

The term “zero-click” has a boundary that is easy to misunderstand. It means users do not need to actively click a link, download an attachment, or authorize an operation. It does not mean the attacker needs to do nothing. The attacker still needs to be able to initiate communication with the target and prepare a sufficiently reliable exploit chain. For users, the danger is that the attack trigger is hidden within the normal incoming-call or call-processing workflow. For attackers, the challenge is making the exploit run reliably across different devices, operating-system versions, and network environments.

Calif has not publicly disclosed the complete vulnerability details, exploit code, or propagation implementation. Given that the relevant vulnerabilities have already been fixed, this approach is closer to responsible disclosure than to publishing a directly reproducible attack chain for everyone.

AI Did Not Create the Vulnerability, but It Significantly Lowered the Barrier to Exploitation

In the past, developing a worm capable of running reliably at scale on real-world communications software typically required collaboration among specialists in vulnerability research, reverse engineering, operating systems, protocol analysis, and payload development. The process could take months. Calif’s assessment is that AI can now handle a large amount of the repetitive work, trial and error, and glue code involved, compressing tasks that would previously have required a large team into days or even less.

This does not mean that AI can “automatically hack into WeChat.” More precisely, AI has changed the engineering efficiency of security research:

• Faster code comprehension: Researchers can ask models to help map out complex protocol-processing logic, memory lifecycles, and exceptional paths.
• Cheaper variant generation: For different input formats, boundary conditions, and system environments, AI can rapidly generate large numbers of test samples.
• Lower debugging costs: Crash logs, register states, and call stacks can be given to models for preliminary attribution, shortening the distance from a crash to an exploitable condition.
• Easier engineering integration: Much of the connecting code between vulnerability validation, process control, network communication, and propagation logic no longer has to be written entirely by researchers.
• More immediate knowledge retrieval: Models can combine public protocol documentation, historical vulnerabilities, and platform behavior within the same round of analysis.

However, in exploit development, the most time-consuming task is often not “writing a piece of code,” but making it sufficiently reliable. Memory layouts, compiler differences, sandbox restrictions, address randomization, version changes, and server-side validation can all leave a large gap between a crash that can be triggered only in a laboratory and genuine remote code execution.

Therefore, the significance of the nine-day figure is not that “AI can now create a worm with one click,” but that the searching, generation, testing, and patching work that previously required substantial human effort has been greatly accelerated by models. The upper limit of an attacker’s capabilities may not have changed immediately, but the time and expertise required to reach that limit are decreasing.

The WeChat Vulnerabilities Have Been Fixed, but Fixing Them Required More Than Updating the Client

This issue involved both the client and the server. Tencent confirmed that the relevant vulnerabilities have been fixed in Android 8.0.77, iOS 8.0.76, and the server-side systems. In other words, relying solely on server-side blocking would not have been sufficient. The client’s parsing of abnormal VoIP data and its memory-safety handling also required patches.

This is particularly relevant to teams that build their own instant-messaging, audio/video, or push-notification systems. Communications protocols typically have several characteristics: data comes from a partially untrusted remote source, the processing path must operate in real time, the underlying code may contain large amounts of C / C++ components, and protocol branches tend to become increasingly complex in order to maintain compatibility with older versions. Together, these conditions are precisely where memory corruption and parsing vulnerabilities can arise.

From an engineering perspective, systems of this type should pay attention to at least the following:

• Apply strict length, type, and state validation to call invitations, media negotiation, and control messages;
• Avoid processing complex, unvalidated data directly in high-privilege processes;
• Add fuzzing, mutation testing, and abnormal-sequence testing to audio/video protocol parsers;
• Perform crash-cluster analysis to distinguish ordinary stability issues from memory-safety problems that can be triggered remotely;
• Manage client versions, server protocol versions, and security policies together to prevent outdated clients from remaining on high-risk communication paths for extended periods;
• Establish risk-control rules for automated contact operations, abnormal calling behavior, and large-scale propagation within a short period.

It is especially important to recognize that the traditional question of “what did the user click?” is not an effective criterion for every attack. Zero-click attacks shift the risk from user behavior to the application’s automatic processing paths. Incoming calls, message previews, image thumbnails, font parsing, Bluetooth broadcasts, and push notifications can all form part of the attack surface.

For Developers, AI-Powered Security Offense and Defense Are Now Entering the Same Pipeline

The most concerning aspect of this disclosure is the potential speed gap between attack and defense.

On the offensive side, AI can continuously generate protocol variants, search for boundary conditions, analyze the causes of crashes, and help turn a single vulnerability into an automated attack chain. On the defensive side, if security teams still rely on manually reviewing logs, summarizing alerts weekly, and scheduling patches monthly, the window between vulnerability discovery and remediation may be compressed even further.

Calif also explicitly proposed that defenders should actively use AI to handle potential risks. For enterprises, this is not a problem that can be solved simply by purchasing an “AI security product.” A more realistic approach is to integrate models into existing development and security processes:

1. Use AI for Code and Protocol Review

Have models focus on boundary checks, integer overflows, length calculations, lifecycle management, exception handling, and the flow of untrusted inputs. Models cannot replace manual audits, but they can first identify high-risk functions and call chains, reducing the scope that auditors need to examine.

2. Use AI to Analyze Fuzzing Results

Large communications systems may generate enormous numbers of crash samples every day. Models can help determine which crashes are merely null-pointer or duplicate exceptions, which samples have reproducibility characteristics across versions, and which issues may be directly related to remote inputs.

3. Use AI to Generate Patch Regression Tests

After fixing a protocol vulnerability, it is not enough to verify only that “the original sample no longer crashes.” Testing must also cover changes in length, out-of-order fields, duplicate fields, truncated data, malformed encoding, and cross-version negotiation. AI is well suited to helping generate these test combinations, but the results must still be verified by deterministic toolchains.

4. Use AI for Continuous Attack-Surface Inventory

For enterprises with multiple clients, SDKs, servers, and third-party dependencies, security teams need to know which components are exposed to the public internet, which protocols receive external data, and which versions have not yet been upgraded. Models can help organize asset and dependency relationships, but data sources must be traceable. Model guesses cannot be treated as factual asset records.

“All Users Are Unaffected” Does Not Mean Updates Can Be Ignored

Current public information indicates that the relevant vulnerabilities have been fixed and that all users are currently unaffected. Nevertheless, users and enterprises should still update their WeChat clients, especially on devices that have not been updated for a long time, run older operating systems, or have clients installed through unofficial channels.

Enterprise administrators also need to consider more specific circumstances: whether employees use personal devices to access business groups, whether older client versions are still permitted to log in, whether mobile-device-management systems can verify application versions, and whether abnormal calls and logins are recorded for auditing. In highly sensitive environments, “I have never clicked a suspicious link” cannot be treated as sufficient proof of security.

It is equally important not to generalize this incident into “WeChat has been widely infected.” What has been disclosed is a research result constructed by security personnel, and the vulnerabilities have already been fixed. The accurate conclusion is that a high-risk attack chain that could potentially be triggered remotely was discovered and patched, while AI significantly shortened the development cycle for that attack chain.

This Is Not a WeChat-Only Problem

VoIP, messaging, image and document previews, and push-notification systems are all frequently used, highly automated entry points in modern applications. Any client with complex data-parsing logic may face similar risks. WeChat is simply the specific platform involved in this incident; this does not mean that other communications software is inherently safer.

For developers, the security assumption that truly needs updating is:

“The user did not take any action” no longer means “the application did not execute high-risk code.”

Applications automatically receive, parse, and render data. Servers automatically process requests. Clients automatically establish connections. As long as these processes can be influenced by remote input, they must be designed and tested as part of the attack surface.

For the AI industry, WeWorm also provides an uncomfortable but highly realistic example: the value of model capabilities is not limited to generating product code and improving development efficiency. It also extends to security research and attack automation. The key to future security competition will not be who can claim “we have no vulnerabilities,” but who can discover problems faster, validate their impact faster, complete remediation faster, and ensure that patches truly cover every client and server version.

As of September 8, 2026, the WeChat vulnerabilities exploited by WeWorm have been fixed, and public information does not indicate that they are currently affecting users. For developers, the most valuable action is not to forward a “WeChat worm” headline, but to inspect their own communications protocols, automatic-processing paths, and boundaries for AI use. Attackers are already using AI to shorten vulnerability-exploitation cycles; defenders cannot continue responding at yesterday’s speed to a new pace of attacks.

References

• ITHome: Security Researchers Used AI to Rapidly Develop the First Zero-Click WeChat Worm Virus; Relevant Vulnerabilities Have Now Been Fixed — Discloses Calif’s research findings, WeWorm’s propagation method, the versions containing the fixes, and the timeline.