AOL patched a flaw allowing remote code execution when it released AOL Instant Messenger (AIM) 6.5, but researchers are still urging caution for enterprise users of the application.