{
  "@context": "https://schema.org",
  "@id": "https://aggr.aymericbeaumet.com/items/simonwillison-net/2026-09-10-quoting-calif-research/#webpage",
  "@type": [
    "WebPage",
    "ArchiveComponent"
  ],
  "articleBody": "> Today, we're releasing a demo of WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android. \\[...\\]\n>\n> The victim does not need to answer the call, or interact with their phone at all. Even if they do answer, they hear nothing, and the exploit still succeeds. \\[...\\]\n>\n> Working with AI, our team found the bug and wrote the first remote code execution (RCE) exploit in about two days. Building the worm took one more week.\n>\n> A worm at this scale used to be the kind of thing that took a larger team months. AI can already do most of the work here. Our team provided the judgment about what to target and how to test it safely.\n\n— [Calif Research](https://calif.io/research/weworm), WeWorm\n",
  "authors": [],
  "captured_at": "2026-09-10T04:31:32.185563254+00:00",
  "category": "programming",
  "content_html": "<blockquote>\n<p>Today, we're releasing a demo of WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android. [...]</p>\n<p>The victim does not need to answer the call, or interact with their phone at all. Even if they do answer, they hear nothing, and the exploit still succeeds. [...]</p>\n<p>Working with AI, our team found the bug and wrote the first remote code execution (RCE) exploit in about two days. Building the worm took one more week.</p>\n<p>A worm at this scale used to be the kind of thing that took a larger team months. AI can already do most of the work here. Our team provided the judgment about what to target and how to test it safely.</p>\n</blockquote>\n<p>— <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://calif.io/research/weworm\">Calif Research</a>, WeWorm</p>\n",
  "content_markdown": "> Today, we're releasing a demo of WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android. \\[...\\]\n>\n> The victim does not need to answer the call, or interact with their phone at all. Even if they do answer, they hear nothing, and the exploit still succeeds. \\[...\\]\n>\n> Working with AI, our team found the bug and wrote the first remote code execution (RCE) exploit in about two days. Building the worm took one more week.\n>\n> A worm at this scale used to be the kind of thing that took a larger team months. AI can already do most of the work here. Our team provided the judgment about what to target and how to test it safely.\n\n— [Calif Research](https://calif.io/research/weworm), WeWorm\n",
  "dateCreated": "2026-09-10T04:31:32.185563254+00:00",
  "date_created": "2026-09-10T00:56:41+00:00",
  "date_modified": "2026-09-10T00:56:41+00:00",
  "date_published": "2026-09-10T00:56:41+00:00",
  "description": "Today, we're releasing a demo of WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android. [...] The victim does not need to answer the call, or interact with their phone at all. Even if they do answer, they…",
  "external_url": "https://simonwillison.net/2026/Sep/10/calif-research/",
  "git": {
    "commit": "ebb0941c5c06a2ab2377342d607535262a3e969e",
    "path": "items/simonwillison-net/2026/09/2026-09-10-quoting-calif-research.md",
    "permalink": "https://github.com/aymericbeaumet/aggr-instance/blob/ebb0941c5c06a2ab2377342d607535262a3e969e/items/simonwillison-net/2026/09/2026-09-10-quoting-calif-research.md"
  },
  "id": "urn:aggr:item:0f3422617b83e7ac1b0af5a083f6139ae1b45817",
  "isBasedOn": {
    "@id": "https://simonwillison.net/2026/Sep/10/calif-research/"
  },
  "mainEntity": {
    "@id": "https://simonwillison.net/2026/Sep/10/calif-research/",
    "@type": "CreativeWork",
    "archivedAt": {
      "@id": "https://aggr.aymericbeaumet.com/items/simonwillison-net/2026-09-10-quoting-calif-research/#webpage"
    },
    "dateModified": "2026-09-10T00:56:41+00:00",
    "datePublished": "2026-09-10T00:56:41+00:00",
    "headline": "Quoting Calif Research",
    "timeRequired": "PT1M",
    "url": "https://simonwillison.net/2026/Sep/10/calif-research/",
    "wordCount": 123
  },
  "name": "Archived snapshot: Quoting Calif Research",
  "preview": null,
  "reading_minutes": 1,
  "replicated_at": null,
  "source": "simonwillison-net",
  "source_name": "Simon Willison's Weblog",
  "summary": "Today, we're releasing a demo of WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android. [...] The victim does not need to answer the call, or interact with their phone at all. Even if they do answer, they hear nothing, and the exploit still succeeds. [...] Working with AI, our team found the bug and wrote the first remote code execution (RCE) exploit in about two days. Building the worm took one more week. A worm at this scale used to be the kind of thing that took a larger team months. AI can already do most of the work here. Our team provided the judgment about what to target and how to test it safely. — Calif Research, WeWorm Tags: ai-security-research, ai, llms, security, generative-ai",
  "tags": [
    "ai",
    "ai-security-research",
    "generative-ai",
    "llms",
    "security"
  ],
  "temporalCoverage": "2026-09-10T04:31:32.185563254+00:00",
  "title": "Quoting Calif Research",
  "url": "https://aggr.aymericbeaumet.com/items/simonwillison-net/2026-09-10-quoting-calif-research/",
  "word_count": 123
}