Calif Research says AI found a zero-click WeChat bug in two days, and its team turned it into a cross-platform worm demo in three weeks

Calif Research published a demo on 8 September of a zero-click WeChat worm that spreads across iOS and Android through incoming calls. The firm says AI found the underlying memory corruption bug in WeChat's VoIP stack in about two days, and its team then built a working cross-platform worm demo over the following three weeks. Tencent patched the flaw for all users before publication.

What was built

The demo uses three phones. A Pixel 10a acts as the attacker and calls an iPhone 17e, taking over the target's WeChat account while the phone is still ringing. The compromised iPhone then calls a second Pixel 10a and takes it over the same way. Calif says the victim does not need to answer the call or touch the phone, and hears nothing if they do answer. Declining the call stops that one attempt. The attacker can try again later, for example while the victim is asleep.

Once the account is taken over, Calif says its exploit can read and send messages, make calls and act as the victim. The firm notes the exploit requires the attacker to be on the victim's friend list, but that an attacker can chain through a compromised contact to reach anyone.

The timeline Calif published

The disclosure timeline is on the research page. AI discovered the bug sometime in July 2026. The team became aware on 23 July and submitted to Tencent on 24 July. The first Android remote code execution exploit was ready by 30 July, the iOS exploit by 2 August, and the polished worm demo by 11 August. Tencent published Android WeChat 8.0.77 and iOS 8.0.76 on 21 August and mitigated the exploit on the server side for all users by 28 August. Tencent confirmed on 4 September that the bug could be used for remote command execution.

What Calif says about the AI's role

Calif's own words: "Working with AI, our team found the bug and wrote the first remote code execution (RCE) exploit in about two days. Building the worm took one more week." The team's role, in Calif's telling, was judgment about what to target and how to test safely.

The firm does not name the models used and is holding back the technical details of the bug for a conference talk. The New York Times has separate coverage of the release.

The consequence for a defender is a change in cadence. The one-line summary Calif gives, that this used to be work for a larger team over months, is the number that matters here: if the discovery step now takes days, the window between a bug existing and a working exploit existing has closed. Anyone shipping a messaging app, a mobile SDK, or code that touches a real-time media stack should assume this style of research is within reach of a small team with an AI budget. Server-side mitigation of the WeChat flaw was Tencent's fastest lever; that lever has to be reachable on every message app in production.

Source

Primary: Calif Research, WeWorm, 8 September 2026. Surfaced via Simon Willison's blog.