US firm used AI to hijack WeChat account, spurring call for cyber cooperation with China

Beijing - Chinese messaging giant WeChat has patched software flaws disclosed by a US cybersecurity firm that highlighted the potential for artificial intelligence to exploit them. Over a billion users globally rely on WeChat for messaging, payments and other services. The US group, Calif, presents itself as "hackers making the internet safer for everybody" by uncovering flaws in apps and programmes.

Calif's researchers employed AI to construct a worm capable of spreading via phone calls to WeChat contacts, though they did not release it. No account takeover is required; a simple call triggers full control of the account, enabling message reading and sending, calls, and carrying out actions on behalf of the victim, according to Calif's blog post.

The issue could be compounded when combined with other mobile phone vulnerabilities, granting control over the device. Tencent, WeChat's parent company, acknowledged receiving Calif's notification of a "potential security issue." A fix was implemented on Tencent's servers and is now available to all users without needing an app update.

No evidence suggests the vulnerability was exploited or that any user was affected. The tech giant expressed gratitude to the researchers for alerting them. The research underscores growing concerns over AI's role in digital security, prompting calls for enhanced defenses from governments and corporations. Calif emphasized that AI enables less-skilled actors to find vulnerabilities, leaving ordinary users at risk.

The issue may be addressed during an upcoming White House meeting between President Donald Trump and Chinese President Xi Jinping. Calif's chief, Thai Duong, posted on social media that AI should not be a topic of debate between the two countries, as ensuring online safety for billions of people should be a priority.