WeChat’s 1.4 Billion Users Faced a Dangerous Security Flaw. AI Helped Turn It Into a Self-Spreading Worm.

Artificial intelligence created a worm inside WeChat so that a missed call could have been enough to surrender control of a WeChat account to a hacker. The contact would not have made the call, and the victim would not have needed to answer.

Once inside, the malicious software could use the account's saved contacts to repeat the attack, turning a familiar phone number into the next delivery system. That is the scenario researchers at Calif, a Palo Alto cybersecurity company, demonstrated with a computer worm they named WeWorm.

The team built the tool in a little more than a week with help from advanced artificial intelligence models, exposing a vulnerability in one of the world's largest messaging platforms.

Tencent, which owns WeChat, confirmed the flaw and said it had fixed the issue after Calif contacted the company. A spokeswoman said Tencent had no reason to believe any users were affected or that security had been compromised. Customers do not need to update the app, the company said.

According to Calif's research, the worm exploited a flaw in WeChat's voice-calling system. The researchers demonstrated the attack using an Android device that initiated a call to an iPhone, took over its WeChat account while the phone was ringing, and then used that compromised account to attack another Android device.

The victim did not have to answer, click a link, or interact with the phone. Once compromised, an account could be used to read and send messages, make calls, and impersonate its owner. Calif said additional vulnerabilities could potentially allow an attacker to gain full control of the device itself.

WeChat grants certain privileges to people already saved as friends, and the worm could exploit that relationship to move from one account to another. A compromised contact could therefore become the gateway to everyone in that person's address book.

Calif described WeWorm as the first known zero-click worm capable of spreading through WeChat calls across both Apple's iOS and Google's Android. The company said it used a combination of open-source and leading U.S. AI models, but did not identify them.

The distinction between the researchers' demonstration and an actual outbreak is important. The worm was a proof of concept, and there is no evidence that millions of WeChat users were hacked. Vinh Nguyen, a former National Security Agency chief data scientist, told The New York Times that the worm's ability to spread exponentially could have allowed it to reach hundreds of millions of devices within hours.

WeChat has more than 1.4 billion monthly active users, according to the company, making the scale of the hypothetical threat extraordinary. Calif reported the flaw to Tencent in July and said it had mitigated the exploit for all users by August 28.

Calif said its team discovered the bug and developed the first remote-code-execution exploit in about two days, then spent another week building the worm. The models accelerated the work, but researchers selected targets, supervised the process and tested the results. The disclosure follows an open letter signed by more than 100 technology companies, including OpenAI, warning that AI-enabled cyberattacks could become more widespread and sophisticated.