Quoting Calif Research
Simon Willison’s Weblog Simon Willison
Calif Research says it made WeWorm, a zero-click worm that spreads through WeChat calls on iOS and Android. It says AI helped find the bug and build the exploit fast, which is a grim speedup.
Based on reporting by Simon Willison’s Weblog, Simon Willison — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Calif Research says it has released a demo of WeWorm, which it calls the first zero-click worm to spread through WeChat calls on both iOS and Android. The pitch is unsettlingly simple: the victim does not need to answer the call, and doesn’t need to touch the phone at all for the exploit to land.
The group says that even if someone picks up, they hear nothing and the attack still works. That detail matters because it strips away the usual escape hatch people imagine with suspicious calls. There is no obvious user mistake to blame here. Just a call, and then code running where it should not.
The other half of the story is how quickly it came together. Calif Research says it worked with AI to find the bug and write the first remote code execution exploit in about two days. Building the worm itself took one more week. That is a short timeline for something that, by its own description, used to take a larger team months.
The team says AI did most of the work, while humans handled the judgment calls: what to target, and how to test it safely. That is the part that should make defenders uneasy. The tools are no longer just helping with paperwork or summarising logs. They are compressing the time from bug to weapon.
And once that gap shrinks, everyone else gets less time to react.
My take — AI-written commentary, not fact-checked reporting
This is exactly the sort of story that should puncture the AI safety theatre. The scary part isn’t that machines are clever; it’s that they’re making old-school attack work cheaper, faster, and available to smaller crews. The industry keeps selling productivity, and then acts surprised when productivity shows up wearing a balaclava.
Read more about this at: Simon Willison’s Weblog
