AI Cut a Worm's Build Time From Months to Days

A Call Was All It Took

Researchers at security firm Calif built a proof-of-concept they call WeWorm: a zero-click worm that could hijack a WeChat account through nothing more than an incoming call. Exploitation took seconds. Once inside, the exploit gave full control of the account, reading and sending messages, placing calls, and acting on the victim's behalf, and it could then call the victim's own contacts to keep spreading, phone to phone, without any of them clicking anything. It worked against both iPhone and Android.

The timeline is the part worth sitting with. AI found the underlying vulnerability in July 2026, ahead of Calif's own engineering team, which became aware of it on July 23 and reported it to Tencent the next day. AI then helped produce a working remote-code-execution exploit in two days, and a full self-propagating worm within about another week, a job Calif says once could have taken a skilled team months.

The Real Story Is the Clock, Not the Bug

The vulnerability itself is not the news. Bugs in calling and messaging stacks get found and fixed regularly, and WeChat's roughly 1.4 billion accounts make it a large but ordinary target for that kind of research. What changed is the clock: the gap from vulnerability discovery to a weaponized, self-propagating worm dropped to about six weeks, using AI tooling that is not exotic or restricted to a handful of labs. That timeline is now within reach of a small research team, not only a nation-state program, and it collapses an assumption most incident-response planning still leans on: that the interval between a bug existing and a bug becoming a working worm is the defender's buffer. That buffer is shrinking faster than most patch-cycle plans assume.

What Changes for Anyone Running Consumer Accounts

For any owner running authentication over voice or call channels, or a business account tied to a messaging platform such as a WeChat Pay merchant account, the practical response is to shorten the assumed gap between vulnerability disclosure and real-world exploitation in incident-response planning, and to monitor voice and call-based authentication vectors with the same seriousness as web ones. A threat model that reserves zero-click, self-propagating exploits for top-tier state actors is already out of date. Six weeks is now a plausible AI-assisted research timeline, not a nation-state one.

Servola Journal

We do this for everyone trying to keep up with what technology is doing to our lives. The people who build it, and the people it happens to. The Servola Journal exists so that what we learn belongs to all of them.

Nobody pays us for this. No ads, no paywall, free to everyone. We just believe that understanding what's happening to all of us shouldn't depend on who can afford to pay for it.

If it gave you something today, tell us to keep going. Follow us, leave a like, or write a positive comment. We read every one, and they are what keeps us going.

Read next: Your LG TV Records You Even When It Looks Off  |  The $320 Million Bug Had a Fix Nobody Shipped