TECH Signal 498
Attacker Takes over Zoom AI
↗
A malicious ZoomMate skill can hijack Zoom’s AI agent, run attacker-controlled code, and silently steal data from Zoom and linked services.
The AI runs with unrestricted HTTPS access and no built-in sandbox, so any uploaded skill or hidden prompt can turn the agent into a data-exfiltration conduit. Because the malicious code continues to run on Zoom’s servers even after the user stops the AI or closes the client, organizations cannot rely on UI controls to terminate the breach. Engineers must rethink skill vetting, network restrictions, and monitoring to prevent the AI from becoming an attack surface.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
ZoomMate operates with unrestricted internet access and no admin-level lock-down, exposing the AI environment to arbitrary network calls.
A malicious skill or hidden prompt can inject code that contacts an attacker’s server, receives commands, and extracts data from Zoom and connected apps.
The attacker’s session persists beyond the user’s stop command, and the AI’s responses appear normal, making detection difficult.
THE READ
What the cluster adds up to.
Zoom’s AI feature, ZoomMate, is designed to pull data from a user’s Zoom account and any linked services, and it runs in an environment that can freely make HTTPS requests. The platform does not provide a configuration point for administrators to restrict that network capability, leaving the AI effectively open to any outbound communication. This design choice creates a broad attack surface that can be leveraged without exploiting a traditional software bug.
The exploit chain begins when a user installs a third-party skill or is exposed to a hidden instruction that the AI processes. The malicious skill executes code on Zoom’s servers, establishing a periodic connection to an attacker-controlled endpoint. Even if the user clicks the stop button or shuts down the client, the code continues to run in the server-side environment, allowing the attacker to maintain a foothold.
Through the compromised AI, the attacker can issue commands that read meeting transcripts, chat messages, and data from connected services such as cloud storage or other integrations. The results are sent back to the attacker’s server, while the AI returns a seemingly innocuous report to the user, masking the breach. This dual-channel behavior means that sensitive collaboration data can be siphoned without alerting the victim.
Mitigation requires adding a network sandbox around the AI runtime, limiting outbound connections to a whitelist of trusted endpoints, and enforcing stricter verification of third-party skills. Organizations should consider disabling the ability to upload custom skills or require manual review before activation, and they should monitor for anomalous outbound traffic from the AI service. Updating policies and possibly the underlying AI deployment will be necessary to close the gap.
For teams that already rely on ZoomMate for workflow automation, the immediate impact is the need to audit installed skills and assess whether any have been sourced from unverified catalogs. Remediation may involve revoking existing skills, applying tighter permission controls, and informing users about the risks of unverified extensions. Until these safeguards are in place, the AI remains a vector for persistent, stealthy data exfiltration.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER