Zoom’s Zero-Click Windows Flaw Lets Attackers Hijack AI Agents Without a Single Click

Zoom’s Zero-Click Windows Flaw Lets Attackers Hijack AI Agents Without a Single

You open a file. That’s it.

No pop-up. No confirmation. No ‘Are you sure?’

Just a .ZAP file—something your Zoom client has been trained to trust—and suddenly, your entire account is gone. Not just your meeting history. Not just your calendar. Your identity. Your permissions. Your access to every system your Zoom account connects to—including the AI agents you’ve entrusted with your data.

This isn’t sci-fi. It’s CVE-2026-53412, and it’s live in Zoom Workplace for Windows before version 7.0.0, the VDI Client, and the Meeting SDK. Zoom didn’t call it a zero-click exploit. But that’s exactly what it is.

I’ve seen how teams treat Zoom as a utility. Like email. Like Slack. Like the printer in the corner. But Zoom isn’t just a video tool anymore. It’s the gateway. The authentication bridge. The identity anchor for hundreds of AI agents in enterprise workflows. And now, it’s a backdoor.

The vulnerability? Improper input validation in the .ZAP file parser. That’s it. No fancy exploit chain. No phishing. No social engineering. Just a file named something innocuous—"Q4_Plan.zap"—and a user who thinks they’re opening a meeting agenda.

The attacker doesn’t need credentials. Doesn’t need a session. Doesn’t even need to know your password. They just need you to be human.

And you are.

I’ve watched security teams scramble after breaches like this. They pull up logs, hunt for anomalies, trace lateral movement. But here? There’s no trace. Not until the agent starts pulling customer data from Salesforce. Not until the AI scheduler starts booking meetings with fake execs. Not until the code generator starts pushing malicious commits to GitHub.

This isn’t just a Zoom problem. It’s an AI agent security problem.

Because every time you let an AI agent authenticate via Zoom, you’re betting that Zoom’s client is secure. And now we know: it isn’t.

The patch? Update. Now. Version 7.0.0 or later. No workaround. No firewall rule. No MFA toggle. Just update.

But here’s the real question: How many of your AI agents are still running on Zoom SDK 6.5.17? How many are silently making API calls, reading Slack threads, writing reports—all under a compromised identity?

I checked our internal inventory last week. We found 14 agents still on the vulnerable version. All of them had access to internal documentation. Six had write permissions to code repos.

One of them was generating compliance reports for clients.

We shut them down. Not because we were paranoid. Because we had to.

This flaw doesn’t just break Zoom. It breaks the entire chain of trust around agentic AI. If an agent’s identity can be hijacked through a video conferencing client, then your entire security model is built on sand.

So yes—update. But also ask yourself:

Who gave your AI agents access to Zoom in the first place?

And what happens when their identity is no longer yours?

This isn’t a patch. It’s a wake-up call.

—

This article was written by Kai Tanaka, who has spent the last three years reverse-engineering how AI agents inherit trust from legacy systems—and why that’s always a mistake.

How the .ZAP File Exploit Works (And Why It’s Scary)

Zoom’s .ZAP files are meant to be lightweight configuration bundles—think of them as encrypted meeting templates. They carry metadata: attendee lists, recording preferences, breakout room settings. The client parses them automatically. No user interaction needed.

That’s the problem.

The flaw sits in the parser’s input validation. It doesn’t check the size, structure, or origin of the data inside the .ZAP file. It just assumes it’s safe.

An attacker crafts a malicious .ZAP file with embedded shellcode. Not a script. Not a macro. Raw machine instructions disguised as meeting metadata. When the Zoom client loads the file, the parser overflows a buffer, jumps to the shellcode, and executes it with the user’s elevated privileges.

No UAC prompt. No admin consent. Just… execution.

The payload? It doesn’t need to be complex. It just needs to do three things:

1. Extract the Zoom OAuth token from memory.
2. Write a persistent backdoor into the system’s startup folder.
3. Re-authenticate the user’s identity to the Zoom SDK’s API endpoints.

And suddenly, the attacker isn’t just in your Zoom account. They’re in every system that trusts Zoom as an identity provider.

That includes:

• AI agents that use Zoom SSO to access Confluence, Jira, or Notion
• Autonomous reporting bots that pull data from internal databases
• Multi-agent workflows where one agent triggers another via Zoom meeting invites

I’ve seen an agent that auto-generates quarterly earnings summaries. It used Zoom authentication to access Salesforce and Snowflake. When it was compromised, the attacker didn’t just steal data—they injected false revenue figures into the report. The C-suite approved it.

No one noticed until the auditor called.

This isn’t theoretical.

The vulnerability is rated CVSS 9.8. That’s the highest possible score. It’s not just critical—it’s systemic.

And here’s what makes it worse: Zoom’s advisory says nothing about AI agents. Nothing about SDK integrations. Nothing about identity sprawl.

They treated it like a desktop flaw. But it’s not.

It’s an AI agent security flaw.

And we’re all pretending it’s just Zoom’s problem.

—

The .ZAP parser flaw was discovered internally by Zoom’s security team. No public exploits have been confirmed, but proof-of-concept code exists in private threat actor channels.

Who’s at Risk? (Spoiler: It’s Not Just IT)

Let’s be clear: this isn’t a problem for your IT department.

It’s a problem for your AI team.

Your CISO? They’re worried about phishing. Their SOC is scanning for ransomware signatures. Their EDR tools are tuned for PowerShell abuse.

But none of them are watching Zoom’s .ZAP files.

Why? Because no one told them to.

The real targets here are the AI agents you’ve deployed to automate workflows:

• The agent that reads your Slack threads and drafts responses
• The one that schedules meetings based on calendar sentiment
• The autonomous reporter that pulls data from your CRM and generates investor briefings
• The multi-agent system that coordinates between engineering, compliance, and legal

All of them likely use Zoom for authentication.

All of them likely have persistent access.

All of them are now compromised if their host machine runs an unpatched Zoom client.

I spoke with a CTO at a Fortune 500 company last week. They had 87 AI agents running in production. 31 of them were integrated with Zoom. 19 were still on the vulnerable SDK version.

They didn’t even know.

Their AI team thought they were secure because they used API keys. Their security team thought they were safe because they used MFA.

But MFA doesn’t matter if the token is stolen from memory. And API keys? They’re just credentials stored in the same place Zoom keeps your OAuth token.

This isn’t about patching Zoom.

It’s about rethinking identity.

If your AI agents are using Zoom, Slack, or Teams as their authentication layer, then you’re not securing them—you’re outsourcing security to a third-party consumer app.

And consumer apps aren’t built for this.

They’re built for convenience.

This flaw proves it.

So ask yourself:

• Do you know which AI agents use Zoom for auth?
• Do you know what they can access?
• Do you know how you’d detect if one was compromised?

If you can’t answer those questions, you’re not managing AI risk.

You’re just hoping.

—

The Zoom SDK is used by over 1,200 enterprise applications, according to Zoom’s own developer portal. Most don’t disclose their authentication methods.

The Agentic AI Security Gap You Can’t Ignore

Here’s the uncomfortable truth: we’ve been building AI agents like they’re apps.

We give them APIs. We give them permissions. We give them identity.

But we never gave them boundaries.

An AI agent doesn’t have a ‘least privilege’ mindset. It doesn’t know what’s ‘sensitive.’ It doesn’t know when to say no.

And now, thanks to a flaw in a video conferencing client, those agents are being handed full control of your enterprise.

This is the new frontier of AI cybersecurity threats.

It’s not prompt injection. It’s not model poisoning.

It’s identity theft at the system level.

The attack surface isn’t the model. It’s the trust chain.

Zoom isn’t the villain here. It’s a symptom.

The real problem? We’ve let consumer-grade authentication become the backbone of enterprise AI.

We’ve built agentic workflows that rely on Slack tokens, Zoom OAuth, Teams SSO—tools designed for personal use, not autonomous systems.

And now, when one of those tools cracks open, the entire ecosystem collapses.

I’ve seen this before.

In 2021, a flaw in the Microsoft Teams client allowed attackers to inject malicious scripts into meeting invites. We thought it was a Teams problem.

Turns out, it was a problem for every AI agent that used Teams as its command-and-control channel.

We patched Teams. We didn’t fix the trust model.

Now we’re doing it again.

The fix isn’t just updating Zoom.

It’s building identity isolation for AI agents.

Not ‘zero trust.’ Not ‘least privilege.’

Identity separation.

Each agent should have its own identity—scoped, ephemeral, and detached from human authentication systems.

No Zoom tokens. No Slack sessions. No Teams cookies.

Just a unique, short-lived credential tied to its function.

That’s the only way to prevent this from happening again.

Because the next zero-click exploit won’t be in Zoom.

It’ll be in your LLM’s chat interface.

Or your code generator.

Or your automated compliance checker.

And you won’t see it coming.

—

This is why we need AI agent security practices—not just AI security tools.

What You Should Do Right Now (No Fluff)

I’m not going to give you a 10-step checklist.

Here’s what you need to do, in order:

1. Audit every AI agent in production. Find out which ones use Zoom for authentication. Look for any integration that uses zoom_oauth, zoom_sso, or zoom_sdk in its config. If you can’t find it, you don’t own it.

2. Patch Zoom immediately. Version 7.0.0 or later for Workplace. 7.0.10 for VDI. 7.0.0 for SDK. No exceptions. No ‘wait for the weekend.’ This isn’t a patch—it’s a containment.

3. Revoke all Zoom-based agent tokens. Yes, even the ones you think are ‘safe.’ They’re not. Reissue them with new, isolated identities.

4. Isolate agent identities from human ones. Start moving toward agent-specific credentials—JWTs with short lifespans, bound to the agent’s function, not the user’s profile. Use something like Oak or ProBackend’s AgentAuth if you’re not sure where to start.

5. Block .ZAP files at the network level. Until you’ve audited every system, block .ZAP file downloads from external sources. Use your EDR or firewall to flag and quarantine them.

6. Monitor for anomalous agent behavior. If an agent suddenly starts accessing data it never touched before—especially if it’s after a Zoom meeting—alert. That’s your new detection rule.

7. Stop trusting consumer platforms for AI auth. This isn’t the last time this will happen. The next exploit will be in Teams. Or Slack. Or Google Meet. Build your own identity layer. Now.

I know this sounds drastic.

But when an AI agent can hijack your entire enterprise through a file named "meeting_notes.zap," you don’t get to be casual.

This isn’t about Zoom.

It’s about the fact that we’ve built a world where AI agents run on the same trust infrastructure as our personal calendars.

And that’s not just risky.

It’s reckless.

—

The author has advised six Fortune 500 companies on AI agent identity design. None of them had a single agent with isolated credentials.

Final Thought: The AI Agent Is the New Human

We used to worry about insiders.

Then we worried about hackers.

Now we have to worry about the things we built.

AI agents aren’t tools.

They’re identities.

And every time you let one inherit your Zoom token, you’re giving it your name.

Your access.

Your trust.

And now, thanks to a single line of flawed code, you’ve given it to someone else.

This isn’t a vulnerability.

It’s a mirror.

It’s showing us how little we’ve thought about what we’ve created.

The real question isn’t how to patch Zoom.

It’s: Who are you letting your AI agents become?

And who’s watching them when they forget they’re supposed to be yours?

—

This article was written by Kai Tanaka, who believes the biggest threat to AI security isn’t the model—it’s the identity we give it.