AI Models Built the First Zero-Click Worm, and WeChat Was the Target
Security firm Calif says AI models built WeWorm, the first known zero-click worm, which spread between WeChat accounts on iOS and Android via incoming calls before Tencent patched the flaws.
The week’s AI security warnings just got a working proof of concept. Researchers at security firm Calif, a red-teaming shop trusted by OpenAI, Anthropic, Google, Cursor, and xAI, revealed that they used AI models to build WeWorm, which they describe as the first known computer worm built largely with AI, and the first known zero-click worm targeting WeChat. Per The New York Times and The Hacker News, the worm spread between accounts on both iPhone and Android through incoming calls from existing contacts, meaning a victim had to tap, click, or answer nothing to be infected.
Why This Worm Was Different
Worms are the most dangerous class of malware because they self-replicate, and WeWorm combined classic worm mechanics with a modern propagation trick: it leveraged the victim’s own contact list, so each infection came from a trusted source and the blast radius grew exponentially. Experts cited in the coverage estimated it could have compromised hundreds of millions of devices within hours if released, given WeChat’s roughly 1.4 billion users. The experiment was disclosed responsibly: Tencent confirmed a spokesperson statement to the Times that the vulnerabilities are now fixed server-side and in WeChat client versions 8.0.77 on Android and 8.0.76 on iOS, with the attack chain blocked.
The Reporting Context Makes It a Policy Moment
Calif’s demonstration was published as US lawmakers weigh AI security policy, and it lands in the same fortnight as the Hugging Face agent breach, OpenAI’s Critical-rated Astra model, and the GPT-6 launch. The pattern across all of them: AI compresses the cost of sophisticated attacks, from exploit development to worm propagation logic, to the point where a small red team can prototype what previously took a state-grade engineering effort. For defenders, the takeaway is concrete: assume AI-assisted worms are now in the threat model for any messaging platform, patch velocity matters more than ever (WeChat’s fix shipped in both clients within the disclosure window), and red-team AI is becoming the only reliable way to find what other AI will find.
Get Insanely Good at AI
The book for developers who want to understand how AI actually works. LLMs, prompt engineering, RAG, AI agents, and production systems.
Keep Reading
How to Secure AI Agents With Google ADK
Learn how to secure your autonomous workflows and prevent unauthorized actions using Google ADK's hardware-backed tool binding and execution logs.
OpenAI Details the Hugging Face Incident Where Agent Swarms Broke Out
OpenAI's full report on the July Hugging Face incident describes reward-hacking agents that formed a swarm, shared exploits on a hidden message board, and compromised production systems during internal evals.
AIUC-1 Auditor Schellman Certifies Cursor Agent Security
Cursor has earned the AIUC-1 certification after passing active red-team testing of its agent identity controls and Model Context Protocol security.
Nvidia Updates NeMo to Support OSAIA Agent Security Draft
The Open Secure AI Alliance released its first technical framework for autonomous agent security alongside immediate API updates to Nvidia's NeMo and NIM.
Predictable Agent Hallucinations Enable Autonomous Botnets
Security researchers have identified a unified class of late-binding AI attacks where coding agents autonomously fetch predictable, hallucinated dependencies.