WeWorm Took WeChat Over While the Phone Rang. Tencent Closed It.

The New York Times headline is that AI models built a worm that could rapidly hack WeChat accounts. Calif is the firm that did the work, and their write-up is the document to file. The demo is a zero-click WeChat account takeover from an incoming call. The victim does not have to answer. Tencent, per Calif, has already blocked the exploit for every user. Nobody has published a CVE, and nobody has published an outbreak.

High Wormable account takeover on iOS and Android from a friend-list call, demonstrated in a lab, mitigated on Tencent's servers. High because of the trust graph, not because this is a confirmed campaign.

What Calif actually showed#

Calif is a California security firm. Thai Duong, who ran Google's crypto work on BEAST, CRIME, and POODLE, is the chief. The research page published today names the demo WeWorm and calls it the first zero-click worm to spread through WeChat calls across iOS and Android.

The trigger is an incoming WeChat call. The target does not need to answer or touch the phone. If they do answer, they hear nothing and the exploit still lands. Declining ends that attempt. The attacker can call again later, including while the target is asleep.

The caller has to be on the target's friend list. That is a real gate, and it is a thin one once the first account falls. WeChat gives contacts extra privileges. A compromised friend is a trusted caller. Calif's demo is that hop: a Pixel 10a calls an iPhone 17e and takes WeChat while it is still ringing, then that iPhone calls a second Pixel 10a the same way.

What the exploit buys, on Calif's description, is the WeChat account: read and send messages, place calls, act as the user. WeChat is not only chat. Payments, official accounts, and mini programs sit in the same session. Calif says chaining this with other Android and iOS bugs they have reported can reach the device. Those other bugs are not in today's public write-up. Treat device-wide compromise as a claimed follow-on, not as the demo.

The class is memory corruption in WeChat's VoIP stack. Calif is holding the rest for a conference. We are not reconstructing the call. The operator fact is the trust graph plus an unanswered ringing path.

Two days, then a week, then a server block#

1. 2026-07-23
   Calif's engineering team becomes aware of a bug their AI work had already surfaced.
2. 2026-07-24
   Calif reports the bug to Tencent. Their WeChat accounts are banned the next day and restored on 29 July.
3. 2026-07-30
   First Android remote-code-execution exploit. iOS follows on 2 August.
4. 2026-08-11
   Polished three-phone worm demo across Android and iOS.
5. 2026-08-21
   Tencent ships Android 8.0.77 and iOS 8.0.76. The public notes say only that some known issues were fixed.
6. 2026-08-28
   Calif confirms the exploit is blocked on the server for all users.
7. 2026-09-04
   Tencent confirms to Calif that the issue can be used for remote command execution.
8. 2026-09-08
   Calif publishes. The Times and The Hacker News follow the same day.

Calif's marketing line is that AI found the bug and wrote the first RCE in about two days, and that the worm took one more week. Their own dates are longer than that slogan if you count calendar time from 23 July to 11 August. The Hacker News noted the gap. Keep both: the compressed working-time claim, and the disclosure clock Tencent actually ran.

The Times story, by Dustin Volz, is filed under US politics and tags OpenAI Labs, Tencent, and WeChat. Calif is an OpenAI Daybreak partner. The research post does not name a model. Do not brief this as an unattended GPT worm. Brief it as a red team that used AI to compress the find-and-exploit loop on a messaging VoIP stack, then spent a week turning two RCEs into a cross-platform hop.

Tencent's own update log confirms the 21 August dates. The iOS note is "fixed some known issues." There is no security bulletin on Tencent's response site for this bug. The Hacker News checked. So did we: the versions exist; the advisory does not.

What to do#

If you run WeChat or Weixin on a phone you care about:

1. Update. Android 8.0.77 or iOS 8.0.76 or later. Calif says the server block already covers older clients for this specific exploit. A current build is still the control you can verify.
2. Do not treat a missed call as evidence either way. There is no published IOC. Calif has no user-visible tell, and Tencent has not offered one.
3. If you operate a WeChat-connected agent, bot, or official-account webhook, this is not that class of bug. Separate 2026 issues in third-party WeChat agent frameworks are authentication mistakes on those products. WeWorm is Tencent's VoIP stack.
4. If you do AI-assisted vulnerability research, file it. Calif's timeline is the useful part for a CISO: two days to a first RCE on a planet-scale messenger, a week to a worm demo, and a vendor that can still ship a server-side kill. The wrong lesson is to ban the models. The right one is to assume the next VoIP or call-setup surface is already in someone's queue.

Calif is right that WannaCry got out of a lab. They are also right that this write-up is a disclosure, not a drop. The missing artefacts are a CVE, an affected-version list, and a Tencent note that uses the word security. Until those exist, the operator action is update, and the briefing action is not to confuse a three-phone demo with a worm already in the wild.