Calif Research demos a zero-click worm spreading through WeChat calls

Calif Research has released a demo of a worm it calls WeWorm. According to the team, it is the first zero-click worm to spread through WeChat calls across iOS and Android.

The company says the victim does not need to answer the call or interact with the phone in any way. Even if the call is answered, the recipient hears nothing and the exploit still succeeds.

Two days, then one week

Calif Research states that, working with AI, its team found the bug and wrote the first remote code execution (RCE) exploit in about two days. Building the worm itself took one additional week.

The team's own framing: a worm at this scale used to be the kind of project that took a larger team months. In its assessment, AI can already handle most of the work, while the team supplied the judgment about what to target and how to test it safely.

Where this comes from

The statements come from a quotation collected by Simon Willison and posted on his blog on 10 September 2026. Beyond the quotation, no further technical detail was shared about the affected component or whether a patch exists.

The notable claim here is less the attack chain itself than the timeline: an attack tool described as previously requiring months of work by a larger team was reportedly assembled in nine days. The full quotation is available on Simon Willison's blog.