Picture this: you receive a pet photo from a friend on WeChat, and your AI assistant automatically reads it — then a malicious instruction hidden in the photo's pixels activates. It commands your AI assistant to send the same "poisoned photo" to everyone in your contacts, who forward it to their friends. Throughout the entire process, no one clicks any link, and no one notices anything unusual.
This isn't science fiction. According to The New York Times, researchers have demonstrated this "zero-click AI worm" attack — it can spread through apps like WeChat without any user interaction, turning AI assistants into unwitting accomplices of the attack.
The core of the attack is that an AI assistant's greatest strength is also its vulnerability. To help users summarize chats, analyze images, and auto-reply, platforms grant assistants permission to read text and image content. Worm creators simply turn this harmless capability into a Trojan horse: malicious instructions are encoded into photo pixels or seemingly normal text, and when the AI assistant reads the content, the instructions are parsed and executed along with it. It's like commanding a letter-reader: the letter itself is harmless, but the act of reading triggers the trap.
Even more alarming is propagation efficiency. In the researchers' demonstration, the worm achieved chain propagation in a virtual WeChat environment: one victim's entire contact list fell, and their assistants continued infecting the next batch. Because the whole process happens during the AI assistant's "internal processing" phase, antivirus software can barely intercept it — what it sees is "assistant normally read a message," not "malicious code executed."
This threat is called "zero-click" because traditional attacks require at least one click on a link or opening an attachment, while AI worms skip even that step. You don't need to do anything — you just need an AI assistant running in the background. As Apple, Google, and Microsoft integrate AI assistants into operating systems and messaging apps, hundreds of millions of devices are becoming potential entry points for such attacks.
Security experts' advice returns to the old but increasingly important principles: minimize your AI assistant's permissions — it doesn't need "read everything" access to be useful; stay alert to auto-processed messages — if contacts start sending "strange but harmless" content, that could be a worm spreading; and think carefully about what your "AI assistant can do" — convenience in technology often comes at the cost of expanding the security boundary.
The arrival of AI worms pushes cybersecurity into a new phase: past defense centered on "will a person click," now it's about "will the AI read." As our digital lives depend more and more on AI proxies, ensuring the proxy itself is safe is becoming a more urgent problem than efficiency.