How an open-weight AI model hacked TikTok: the DepthFirst Labs camera and microphone exploit

Researchers at DepthFirst Labs recently took over a smartphone’s camera, microphone, and photo roll by attacking the TikTok app. It was a proof of concept, but it ran against real code: the open-source dependencies underneath one of the most widely used social apps in the world. The flaws it exposed were serious.

The part that stands out is who found them. An autonomous AI agent built on open-weight models from China discovered the vulnerabilities and chained them into a working exploit. Those models are not held to the safety guardrails that leading American AI labs enforce on their own systems. A capability like this used to belong to a state-sponsored team or to a zero-day an intelligence agency kept in reserve. The base model behind this one is a free download.

What the researchers did

The result is a zero-click remote code execution (RCE) chain, the most sought-after class of vulnerability in the exploit market. Ordinary social engineering needs the victim to slip up by clicking a link or opening a file. A zero-click chain needs nothing from the victim except an installed, running app.

The flaw did not necessarily sit in TikTok’s backend cloud infrastructure. It was rooted in the client, in the open-source media-handling libraries and local storage handlers the app uses to process video streams and manage device permissions. Most people think of an app as one product. In practice it is a stack of third-party code, and this exploit went after that stack.

How the chain likely worked

The specific exploit chain has not yet been revealed by depthfirst labs so treat the exploit chain below as a reconstruction of the likely path, not a confirmed one.

The most probable class of flaw is a memory corruption bug, either a heap buffer overflow or an integer overflow (CWE-122 or CWE-190), in an open-source media decoder. Every time a user scrolls the feed, TikTok parses, decodes, and renders compressed video in formats like HEVC, AV1, and VP9. Those routines are complex and have a long history of memory safety bugs.

On that reading, the agent did more than spot the overflow. It would have modeled the app’s memory layout by analyzing the abstract syntax tree and the control flow graph of the compiled binary, found the heap buffer the decoder allocates for incoming video metadata, and built a malformed video packet that overruns it. That packet could plausibly arrive disguised as an ordinary ad or a direct message attachment. When the parser handles it, the overflow overwrites adjacent memory. A virtual function table pointer, or a function pointer used in the decoder’s cleanup phase, is the natural target. When the app then frees the memory, execution jumps to shellcode the AI supplied instead of returning normally.

What turns a crash into a privacy breach is the permission model. Android and iOS sandbox each app (SELinux on Android, the App Sandbox on iOS) so it cannot reach hardware it was never granted. TikTok was granted the camera, microphone, and photo library because it needs them. Shellcode running inside the TikTok process inherits every one of those permissions. The payload only has to make ordinary calls, such as Android’s Camera2 API or Apple’s AVFoundation, to switch on the hardware silently, capture data, and send it to an external command-and-control server. As far as the operating system can tell, a trusted app is doing something it is allowed to do. I find that the hardest part to defend against, because nothing in the sequence breaks a rule the OS enforces.

The model behind it: GLM 5.2 and dfs-large1

Z.ai, a Beijing-based lab, released GLM 5.2 in mid-2026 with a million-token context window and reasoning that benchmarks near the frontier. The weights are public on HuggingFace and ModelScope. Open weights means anyone with enough compute can download the parameters, host the model locally, and fine-tune it. That cuts both ways. Defenders can run it in air-gapped environments so proprietary code never leaves the building. Attackers can strip out the RLHF safety alignment and fine-tune on exploit databases, assembly, and reverse-engineering material. Anthropic and OpenAI, by contrast, restrict cyber-offense capabilities in their frontier models and limit access to vetted security researchers.

DepthFirst built its flagship engine, dfs-large1, on GLM 5.2. Legacy static application security testing (SAST) tools work from regular expressions and known CVEs. They throw many false positives and cannot follow the context-dependent logic flaws behind complex exploit chains. dfs-large1 works as an autonomous agentic pentester trained with Reinforcement Learning from Environment Feedback (RLEF). It operates in a sandboxed environment with compilers, debuggers such as LLDB and GDB, and fuzzing engines.

Its loop runs like this. It ingests the source, using the long context window to map the whole repository, including third-party dependencies and API calls. It forms hypotheses about flaws where user-controlled input meets memory allocation or permission handling. It writes its own C++ or Python fuzzing harnesses instead of waiting for a human to do it. When the fuzzer triggers a segmentation fault, it reads the core dump, register states, stack traces, and memory addresses to decide whether the crash is exploitable. If it finds a controllable instruction pointer or a writable primitive, it writes and compiles shellcode in Python or C over repeated attempts until it reaches remote code execution.

CyberGym, an execution-based benchmark from UC Berkeley that tests autonomous vulnerability analysis on real vulnerabilities in production software, puts open-weight models from Z.ai and DeepSeek on par with restricted U.S. frontier models at agentic pentesting. The gap between open and closed cyber capability has effectively closed, and novice attackers now have access to knowledge that used to belong to elite groups.

This is not an isolated result

The TikTok chain fits a pattern that other teams are documenting.

In August 2026, Palo Alto Networks’ Unit 42 pointed an autonomous system called NOVA at nearly 4,000 widely used open-source projects. It found more than 14,000 confirmed, previously unknown vulnerabilities. NOVA automates the slowest parts of the job, writing fuzzing harnesses and triaging crashes, work that normally costs analysts hundreds of hours. Sam Rubin, Unit 42’s senior vice president of threat intelligence, said the volume of hidden flaws in open-source dependencies means almost every enterprise network is inherently vulnerable. TikTok’s exposure comes from the same kind of dependency.

Unit 42 also documented an AI-augmented ransomware attack on a European software company. The attacker’s agent mapped the network, identified 50 vulnerabilities and attack paths, and compromised the infrastructure in 10 hours. Analysts estimate a skilled human team would have needed at least 10 days.

The governance split is visible too. Anthropic previewed Claude Mythos in April 2026, a model built for long-horizon coding and cybersecurity work. Its internal red-teaming found it could exploit zero-days in production software that human auditors had missed for years, and Anthropic then limited the full model to a controlled group of critical infrastructure and cybersecurity firms. The Trump administration moved toward requiring government security review of frontier models before release. Z.ai took the opposite line and argued on X that “an open world cannot have only open attack surfaces; it must also have an open shield.” The result is that Western defenders often work with restricted models that may refuse to generate certain exploit payloads even for defensive testing, while adversaries run locally hosted open-weight models with no such limits.

Last week the Pentagon’s top cyberdefense officer testified that the U.S. military has seen a tenfold increase in the discovery and exploitation of vulnerabilities tied to the rise of AI as an offensive tool. John Hultquist, chief analyst at Google’s Threat Intelligence Group, calls it the most significant technical change in the nature of cyber threats in decades, one that strengthens elite defenders and lowers the barrier for novice criminals at once.

What DepthFirst says users should do

“You shouldn’t trust any app,” says Qasim Mithani, CEO of DepthFirst Labs. His point is that when an AI can find a media parser flaw and chain a heap overflow with an IPC hijack to switch on your camera and microphone, the idea of user consent stops mattering, because the code goes around it. The usual advice (avoid suspicious links, use strong passwords, turn on two-factor authentication) does little against a zero-click bug, since the victim never does anything.

Mithani advises stripping app permissions down. Revoke camera, microphone, and photo roll access for any app that does not need them for its core function. In this attack the payload runs inside TikTok with TikTok’s permissions, so a permission you never granted is one the exploit cannot use. He also says updates can no longer wait. Install patches the moment a vulnerability is disclosed, because the window between a public CVE and an AI-generated working exploit has shrunk from months to hours.

The same dfs-large1 model that found the TikTok flaw is now being used by enterprise security teams to audit their own proprietary code before it ships. Hamza Chaudhry of the Future of Life Institute warns that more powerful open models are expected in the coming months, and that they will let a wider range of actors hit targets once considered out of reach.