行业动态
simonwillison.net ·
@Simon Willison's Weblog
Calif Research 发布 WeWorm：首个经微信通话传播的零点击蠕虫
Calif Research 称发布 WeWorm 演示，这是首个通过微信通话在 iOS 与 Android 上传播的零点击蠕虫，受害者无需接听或操作手机，即使接听也听不到声音且漏洞仍成功。团队表示借助 AI 约两天找到漏洞并写出首个 RCE 利用，再用约一周构建蠕虫，而以往这种规模的蠕虫需要更大团队数月。该说法为团队自述，尚待独立验证。
AI推荐理由 Calif Research 称发布 WeWorm 演示，这是首个通过微信通话在 iOS 与 Android 上传播的零点击蠕虫，受害者无需接听或操作手机，即使接听也听不到声音且漏洞仍成功。团队称借助 AI 约两天找到漏洞并写出首个 RCE 利用，再用约一周构建蠕虫，而以往这种规模的蠕虫需要更大团队数月。该内容给出具体攻击面与 AI 加速漏洞利用的量化对比，对 AI 安全研究有实际参考价值，但为团队自述，尚待独立验证。
80
正文
> Today, we're releasing a demo of WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android. [...]
>
> The victim does not need to answer the call, or interact with their phone at all. Even if they do answer, they hear nothing, and the exploit still succeeds. [...]
>
> Working with AI, our team found the bug and wrote the first remote code execution (RCE) exploit in about two days. Building the worm took one more week.
>
> A worm at this scale used to be the kind of thing that took a larger team months. AI can already do most of the work here. Our team provided the judgment about what to target and how to test it safely.
— [Calif Research](https://calif.io/research/weworm), WeWorm
Tags: [ai-security-research](https://simonwillison.net/tags/ai-security-research), [ai](https://simonwillison.net/tags/ai), [llms](https://simonwillison.net/tags/llms), [security](https://simonwillison.net/tags/security), [generative-ai](https://simonwillison.net/tags/generative-ai)