On September 8, 2026, Calif Research published a demo of WeWorm, what the team calls “the first zero-click worm to spread through WeChat calls across iOS and Android.” A single incoming WeChat call, never answered, hands the attacker’s account full control of the victim’s WeChat, after which the compromised account calls the next contact. The bug is a memory corruption flaw in WeChat’s VoIP stack, the same class of bug that drives the most expensive exploits on the spyware market. What is different here is how it was built. Per Calif, “Working with AI, our team found the bug and wrote the first remote code execution (RCE) exploit in about two days. Building the worm took one more week.” That is roughly three days of focused work for what Calif describes as something that previously required “a larger team” and “months.”
The demo is real, the disclosure was coordinated, and the underlying flaw is patched. The story worth sitting with is the production time.
How WeWorm actually works
The exploit runs while the victim’s phone is ringing, before the call is answered. Calif’s writeup is direct: “The victim does not need to answer the call, or interact with their phone at all.” If the victim picks up anyway, “they hear nothing, and the exploit still succeeds.” Declining the call stops that particular attempt, but the attacker can try again later.
The compromised device is not, strictly speaking, the attacker’s target. It is the next attacker. Each victim becomes the caller for the next round, which is what makes this a worm rather than a single-target exploit. The demo chain Calif recorded goes Android Pixel 10a (attacker) to iPhone 17e (victim one) back to a Pixel 10a (victim two), with the entire pivot happening over standard WeChat voice calls.
There is a precondition. The attacker has to be on the victim’s WeChat friend list, or to have compromised a friend first. That cuts both ways: it limits blast radius compared with a network-level worm like the Bluetooth-class bugs that propagate to nearby devices, and it makes the social-graph surface the right thing to monitor.
WeWorm takes over the WeChat account, not the underlying phone. Calif’s writeup says chaining WeWorm with “other bugs” Calif has reported against Android and iOS could lead to full device control, but the published demo stays at the app boundary. The narrowest framing of the disclosure is that one WeChat account can be turned into a worm that propagates WeChat-to-WeChat, with no user interaction at any step.
The disclosure, in order
Calif submitted the WeChat bug to Tencent in July, per the research page timeline. The detailed dates: the bug was submitted on July 24, 2026; Calif’s WeChat accounts were banned between July 25 and July 28 and unbanned on July 29; the first Android RCE exploit was completed on July 30 and the iOS RCE exploit on August 2; the polished Android-to-iOS-to-Android worm demo was finished on August 11. Tencent released Android WeChat 8.0.77 and iOS WeChat 8.0.76, the versions that mitigated the bug, on August 21. Tencent confirmed possible remote command execution on September 4. Calif published the writeup on September 8, and Simon Willison’s summary went up at 12:56 a.m. on September 10.
That is a roughly six-week gap between bug submission and public disclosure, and roughly three weeks between the worm demo and the patched client build that neutralized it. It is the kind of timeline that responsible disclosure is supposed to produce, and it is worth noting that Tencent collaborated: Calif writes that, “As of today, they have mitigated our exploit for all users,” and adds, “We’d like to thank Tencent for a successful collaboration.” Server-side mitigations, which Calif confirmed for all users on August 28, are what made the eventual public demo safe to publish.
What “AI did most of the work” means here
The Calif writeup frames the AI’s role with a single line: “AI can already do most of the work here. Our team provided the judgment about what to target and how to test it safely.” That is a careful sentence. It does not say AI wrote the exploit unaided. It says the team picked the target (WeChat’s VoIP stack) and the test discipline (coordinated disclosure, server-side mitigations in place before publication), and AI handled the rest.
This is not Calif’s first AI-assisted disclosure. The Calif publications list shows a steady run of them: “Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell” in March 2026, billed as the first remote kernel exploit both discovered and exploited by an AI; “Codex Hacked a Samsung TV” on April 13, 2026; “Claude Found an Auth Bypass in NSA’s Ghidra Server” on April 8, 2026; “Codex Discovered a Hidden HTTP/2 Bomb” on June 2, 2026; “OEMpocalypse Now” on August 31, 2026, a generic Android-untrusted-app-to-root strategy. WeWorm is the latest entry in a pattern, not an isolated incident, and it is the first in that sequence where the AI-assisted output is a worm rather than a single-target exploit.
The change in scope is the point. A single-target RCE is an exposure. A self-propagating worm is an epidemic curve, and the curve starts when one compromised account calls its first contact.
What This Means
For most WeChat users, the practical risk as of September 10 is bounded: the underlying flaw is patched on the user side, Tencent has shipped server-side mitigations, and the demo is on a fixed platform. If you are running a recent WeChat client on iOS or Android, you should already be protected.
For the people who watch this beat, the implication is different. The WeWorm timeline compresses what was historically a months-long, multi-engineer project into days of focused AI-assisted work. The defender’s clock has shortened by an order of magnitude. That argues for two structural responses that have nothing to do with antivirus: shorter, more reliable patching cycles on high-traffic messaging apps, and disclosure norms that assume the AI-assisted exploit cycle is now the default, not the exception.
It also argues for taking Calif’s other recent disclosures seriously. The FreeBSD kernel RCE, the OEMpocalypse Android root strategy, and now the cross-platform WeChat worm are three distinct AI-assisted research outputs in six months, all from the same lab. The pattern is not going to slow down on its own.
The Bottom Line
Calif Research used AI to find a WeChat memory-corruption bug, write a working remote-code-execution exploit, and turn it into a cross-platform zero-click worm in roughly three days. Tencent patched it before public disclosure, and the lab credited Tencent for a clean coordinated-disclosure process. The bigger story is the timeline: the kind of exploit that used to take a team months is now a single-week AI-assisted build, and the next one is already on its way.