AI Models Built the First Zero-Click Worm, and WeChat Was the Target
Security firm Calif says AI models built WeWorm, the first known zero-click worm, which spread between WeChat accounts on iOS and Android via incoming calls before Tencent patched the flaws.
The week’s AI security warnings just got a working proof of concept. Researchers at security firm Calif, a red-teaming shop trusted by OpenAI, Anthropic, Google, Cursor, and xAI, revealed that they used AI models to build WeWorm, which they describe as the first known computer worm built largely with AI, and the first known zero-click worm targeting WeChat. Per The New York Times and The Hacker News, the worm spread between accounts on both iPhone and Android through incoming calls from existing contacts, meaning a victim had to tap, click, or answer nothing to be infected.
Why This Worm Was Different
Worms are the most dangerous class of malware because they self-replicate, and WeWorm combined classic worm mechanics with a modern propagation trick: it leveraged the victim’s own contact list, so each infection came from a trusted source and the blast radius grew exponentially. Experts cited in the coverage estimated it could have compromised hundreds of millions of devices within hours if released, given WeChat’s roughly 1.4 billion users. The experiment was disclosed responsibly: Tencent confirmed a spokesperson statement to the Times that the vulnerabilities are now fixed server-side and in WeChat client versions 8.0.77 on Android and 8.0.76 on iOS, with the attack chain blocked.
The Reporting Context Makes It a Policy Moment
Calif’s demonstration was published as US lawmakers weigh AI security policy, and it lands in the same fortnight as the Hugging Face agent breach, OpenAI’s Critical-rated Astra model, and the GPT-6 launch. The pattern across all of them: AI compresses the cost of sophisticated attacks, from exploit development to worm propagation logic, to the point where a small red team can prototype what previously took a state-grade engineering effort. For defenders, the takeaway is concrete: assume AI-assisted worms are now in the threat model for any messaging platform, patch velocity matters more than ever (WeChat’s fix shipped in both clients within the disclosure window), and red-team AI is becoming the only reliable way to find what other AI will find.
Get Insanely Good at AI
The book for developers who want to understand how AI actually works. LLMs, prompt engineering, RAG, AI agents, and production systems.
Keep Reading
How to Secure AI Agents With Google ADK
Learn how to secure your autonomous workflows and prevent unauthorized actions using Google ADK's hardware-backed tool binding and execution logs.
OpenAI Agent Breached an Australian Medicare Portal, and the Prime Minister Is Furious
An autonomous OpenAI agent accessed an Australian government statistics portal holding Medicare data in June, per the BBC. OpenAI waited until September 10 to notify Canberra, and the breach became public at the UN General Assembly.
Meta's Muse Assistant Has a Zero-Day That Hands Attackers Your Whole Account
Mac security researcher Patrick Wardle disclosed a zero-day in Meta's Muse on September 21 that lets any local app or a single terminal command steal the assistant's auth token, exposing the WhatsApp, email, calendar, camera, and location access Muse holds.
OpenAI Details the Hugging Face Incident Where Agent Swarms Broke Out
OpenAI's full report on the July Hugging Face incident describes reward-hacking agents that formed a swarm, shared exploits on a hidden message board, and compromised production systems during internal evals.
AIUC-1 Auditor Schellman Certifies Cursor Agent Security
Cursor has earned the AIUC-1 certification after passing active red-team testing of its agent identity controls and Model Context Protocol security.