Two days to write the attack. A WeChat flaw that hijacks an account without you picking up: what moves fast, and what protects. The attack / The fix. The path. Calif's AI finds the flaw, the team writes the attack. Tencent patches, then blocks the attack on its servers. The time. About two days for the first exploit, with AI. Patched on 21 August, blocked on 28 August. What the victim does. Nothing: a call from a contact is enough. Update the app. For WeChat. Account hijacked, the phone too if other flaws are chained. At least 8.0.77 on Android, 8.0.76 on iOS. Turn on automatic updates for your messaging apps: a fix only protects once installed.