A California research team just released details on WeWorm, a zero-click exploit that spreads through WeChat calls on both iOS and Android. The victim doesn’t need to answer the call or touch their phone. If they do answer, they hear nothing. The exploit still works.

That’s concerning enough on its own. What makes this worth your attention is the timeline: working with AI tools, the team found the vulnerability and wrote the first remote code execution exploit in about two days. Building the full worm took one more week.

The researchers noted that “a worm at this scale used to be the kind of thing that t[ook much longer].” The sentence cuts off in the source material, but the implication is clear. What used to require weeks or months of manual reverse engineering and exploit development now takes days with AI assistance.

This isn’t the first time we’ve seen AI accelerate security research. But there’s a difference between using AI to scan for known vulnerability patterns and using it to find novel bugs and build working exploits at this speed. WeWorm represents a proof of concept for something security teams have been quietly worried about: AI doesn’t just make defenders faster. It makes attackers faster too.

The technical details matter here. Zero-click exploits are the top tier of offensive security research. They require no user interaction, which makes them incredibly valuable for both legitimate security research and actual attacks. Finding them typically requires deep knowledge of the target system, patience, and a lot of trial and error. The fact that AI can compress that timeline changes the economics of exploit development.

The broader context

This comes at an interesting moment for AI and security. Earlier this week, Cognition Labs announced they’d factored RSA-260, a 260-digit number that’s used as a cryptographic benchmark. They used AI-assisted techniques to speed up the mathematical work involved. That’s a different domain entirely, but it points to the same pattern: AI is good at accelerating tasks that involve searching through large problem spaces.

Finding exploits is exactly that kind of task. You’re searching through possible inputs, memory states, and execution paths looking for the combination that gives you control. AI models are getting better at that search process.

Meanwhile, on the defensive side, things aren’t moving quite as fast. Google Ads is still serving malicious software ads, according to a detailed writeup published this week. The post walks through how attackers advertise malware on Google’s platform using techniques that aren’t particularly sophisticated. They just work, repeatedly, because the detection systems don’t catch them.

That asymmetry is worth paying attention to. Offense is getting faster. Defense is still dealing with the basics.

What this means for developers

If you’re building anything that handles untrusted input, your threat model just changed. The time between vulnerability disclosure and exploitation has been shrinking for years. Now we’re looking at a world where finding and exploiting novel bugs might happen faster than your security team can patch known ones.

This doesn’t mean AI is inherently an offensive tool. The same techniques that help find exploits can help find bugs before they ship. But right now, the research we’re seeing published is mostly on the offensive side, and that’s the side that moves faster.

The WeWorm researchers published this as a demo, presumably to highlight the risk. That’s standard practice in security research: show what’s possible so defenders know what they’re up against. But it also means the techniques are now public, and the barrier to entry for building similar exploits just got lower.

None of this is theoretical anymore. The exploit exists. It works. And it was built in just over a week with AI assistance. That’s the new baseline for how fast things can move.