Artificial intelligence (AI) and large language models (LLMs) are shifting the way numerous industries function, driving new operational approaches and efficiencies within manufacturing, robotics, technology development, software engineering, robotics, and all other critical infrastructure sectors. Team82 is no different. We have experimented incorporating these advanced technologies into our research methodologies. In this blog, we showcase our use of Anthropic’s Claude Opus 4.6 AI model to uncover vulnerabilities in a popular video intercom platform manufactured by Zenitel. Last November, we disclosed five vulnerabilities in the TCIV-3+ model, a rugged IP-based video intercom that is deployed in many high-security areas and industrial environments. Since we’d already researched this platform and found a range of highly critical command-injection, out-of-bounds write, and cross-site scripting vulnerabilities on the platform, we wanted to see how effective an AI model would be carrying out the same research. How quickly could it find these security issues compared to traditional, manual research? Would it find new vulnerabilities? Would it find new ways to chain the existing bugs into exploits? This automated hands-free approach to vulnerability research is likely the next phase of this cybersecurity discipline. Already we’ve seen the impact of Anthropic’s Project Glasswing, and the rate at which it shrunk the time to find flaws and exploit them. The Claude Mythos frontier AI model behind Project Glasswing is currently available only to a closed preview group of technology companies, including Microsoft, Cisco, Amazon, NVIDIA, and cybersecurity companies such as Crowdstrike and Palo Alto Networks. Enterprises around the world are already rethinking their vulnerability and exposure management programs in anticipation of a wave of new vulnerability reports likely to come their way in the next few months. We believe it’s critical to put these models to the test, throw back the curtain on our own vulnerability research methods, and determine how AI can truly change the course of security research. The Zenitel TCIV 3+ video intercom manages access to secure areas inside buildings and offices. This device features SIP dialing and voice-over-IP (VoIP) functionality together with a video feed and a remote settings and management interface. Our first step last year in researching this platform was to take a software update downloaded from the vendor’s website and extract its filesystem. After doing so, we reviewed the configurations on the extracted filesystem and looked for relevant indications of the device’s web service feature, ipstweb a UPX-packed binary. We unpacked it using the UPX utility and statically analyzed the binary. During the static analysis, we refined the decompilation as much as possible to have a better view of the code flow. Then we started to drill down into as many code flows of the binary that are prone to issues and bugs. Our static analysis and more traditional means of vulnerability research uncovered five vulnerabilities: CVE-2025-64126: An OS command injection vulnerability that enables code execution (CVSS v3, 9.8) CVE-2025-64127: An OS command injection vulnerability that enables code execution (CVSS v3, 9.8) CVE-2025-64128: An OS command injection vulnerability that enables code execution (CVSS v3, 9.8)