The Nightly Build.
Tech News

A Security builds a zero-click Zoom exploit chain with fewer than 20 AI prompts

Zoom has already patched the three linked CVEs, closing out a disclosure that began with a private report to the company in June.

4 min read2026-08-13
Security

A Security chains three Zoom bugs into one zero-click exploit, built in under 20 AI prompts1

A Security says it turned a private vulnerability report into a working, zero-click remote-code-execution chain against Zoom's annotation feature in under 24 hours, using publicly available AI models and fewer than 20 prompts.1 The underlying flaw is present on every Zoom client: Windows, Mac, iPhone, Android, and Linux. The working exploit chain itself, A Security says, was confirmed on four of those five: Windows, macOS, iOS, and Android, with the fullest live demonstration on macOS.1 The chain links three CVEs, 2026-53413 through -53415, and TechRepublic, reviewing the disclosure independently, confirms that timeline, the same four-platform confirmed set, and that Zoom has already shipped patches across the affected products.2 TechRepublic frames it as a capability story before a product-security one: AI is cutting the time and expertise a working exploit chain needs, generally, not only what one team did with this particular chain.2

Open-weight models

Meta distills its closed Muse Spark model into a 30B open one that runs on a single GPU3

Meta Superintelligence Labs released Muse Glimmer on August 10: a 30-billion-parameter, Apache 2.0-licensed model distilled from Meta's larger, closed Muse Spark model.3 It runs on consumer hardware, a 24-32GB memory footprint at roughly 4-bit quantization, tested on a MacBook M4-Max, an M5-Max, and a single RTX-5090.3 Meta's own DFlash speculative-decoding technique speeds inference 3.1x on the RTX-5090, 1.8x on the M5-Max, and 1.5x on the M4-Max.3 The model itself handles agentic tool use, multi-step reasoning, and both text and image input, in more than 100 languages.3 Meta says Glimmer beats Gemma4-31B and Qwen3.6-27B on its own agentic, coding, and safety benchmarks, a comparison no outside source in this record has independently rerun.3 TechCrunch reads the release as a map of Meta's own boundary. Glimmer, in the outlet's words, is "an early indication of where Meta may draw the line between the AI it wants people to own themselves and the more powerful intelligence that remains under the company's control."4

AI infrastructure

IBM and Together AI sign $240 million deal for a Blackwell cluster Together AI expects to sell out months before it comes online5

IBM will build Together AI a dedicated Nvidia HGX B300 inference cluster on IBM Cloud, a $240 million multi-year deal using Spectrum-X networking and targeting Q1 2027 availability.5 Reuters, carried by BNN Bloomberg, puts the initial US deployment at roughly 2,000 Blackwell B300 chips.6 Together AI's chief revenue officer, Kai Mak, is blunt about demand: "We think this will be sold out at least two to three months ahead of time."6 Together AI already serves roughly 400 trillion tokens a month across open models including DeepSeek, MiniMax, and Kimi.7 The Next Web reads the deal as IBM competing on cost per token rather than raw scale against AWS, Microsoft, and Google.7 It points to Nebius's separate $643 million acquisition of an inference-optimization team as the same signal from a different angle: "shaving cost per token is where the margins now live."7

Metabolic therapy

An engineered gut probiotic switches on a diabetes drug only when blood sugar is high8

Guan and colleagues, publishing in Nature, engineered a probiotic that colonizes the gut temporarily and carries a synthetic gene circuit built on the glucose-responsive regulator HexR: it expresses the GLP-1 diabetes drug only once blood glucose crosses a threshold, then stops.8 That closes a gap in prior engineered-cell diabetes therapies, which needed either a surgical cell implant or an external signal to control dosing; this platform needs neither, and is dosed orally.8 The paper reports glycemic control, improved lipid profiles, and fewer diabetic complications in the liver, kidneys, and colon, tested in two diabetic mouse models and, escalating toward humans, in non-human primates with type 2 diabetes.8 China Science Daily, reporting independently of Nature and outside the authors' institution, confirms the same findings and adds that the paper spent roughly three years in review at Nature after an October 2023 submission, a slow, contested path to print rather than a rushed one.9 One figure the paper's abstract leaves out: the exact magnitude of the glucose or HbA1c reduction, which sits in its paywalled full text.

Sources

  1. A Security · Zoomsday: an AI-built, zero-click Zoom exploit chain
  2. TechRepublic · Zoom zero-click RCE: the AI-built "Zoomsday" exploit chain
  3. Meta Superintelligence Labs · Introducing Muse Glimmer, an open agentic model
  4. TechCrunch · Meta's new Glimmer AI model offers a hint at Zuckerberg's personal intelligence vision
  5. IBM Newsroom · IBM and Together AI sign multi-year agreement to scale open-source AI inference with Nvidia AI infrastructure on IBM Cloud
  6. BNN Bloomberg (Reuters) · IBM, Together AI ink $240 million deal for Nvidia-powered AI inference cluster
  7. The Next Web · IBM and Together AI's $240M Nvidia inference cluster
  8. Nature · Guan et al., a programmable, orally deliverable glucose-responsive probiotic for metabolic therapy
  9. China Science Daily (ScienceNet) · A glucose-sensing engineered probiotic for diabetes, a decade in the making