AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs
An autonomous AI agent found 21 zero-days in FFmpeg, while Chrome 149 fixed a record 429 vulnerabilities. The story shows how AI is increasing bug discovery and pressure on patching.
Intelligence analysis by GPT-5.4 Mini
The article pairs two security milestones: AI-driven discovery of long-hidden FFmpeg flaws and Chrome's largest-ever patch release. The common thread is not just more bugs, but faster bug generation, triage, and remediation demands.
A robot helper found hidden holes in a video tool that have been there for years, and Chrome fixed a huge pile of bugs too. It is like a metal detector suddenly finding lots more old coins, but now people still have to dig them up and secure the area.
Analysis
FFmpeg: 21 zero-days from an AI agent
A security startup, depthfirst, says its autonomous agent scanned roughly 1.5 million lines of FFmpeg C code and produced 21 confirmed zero-days, each with a reproducible proof-of-concept input. The company says the run cost about $1,000. Several bugs had reportedly been dormant for 15 to 20 years, including one stack overflow in service-description-table code that dates to 2003.
The flaws span parsers and demuxers, including the TS demuxer and the VP9 decoder. depthfirst says some already have CVE IDs, listing CVE-2026-39210 through CVE-2026-39218, while the rest have been fixed but not yet numbered. It also published a proof of concept.
Chrome's record release
Google shipped Chrome 149 with fixes for 429 security bugs, which the article says is the most ever in a single release. More than 100 are described as critical or high severity, and the worst is CVE-2026-10881, a CVSS 9.6 out-of-bounds read and write in the ANGLE graphics engine that could let a crafted page escape the sandbox and run code on the host. Google paid $97,000 for that issue.
The article says the AI connection here is mainly about volume, not authorship. Google did not tie the 429 bugs to AI, but it did overhaul its bounty program in April after a flood of AI-generated submissions, asking for concise reproducers instead of long AI-written reports.
Wider pattern
The piece connects these releases to other recent AI-assisted findings, including Google’s Big Sleep, Anthropic’s work on FFmpeg, and an autonomous tool that found an authenticated RCE in Redis. The core message is that finding bugs is getting cheaper, while triaging, fixing, and deploying patches remains the hard part.
Key points
- An autonomous AI agent reportedly found 21 confirmed zero-days in FFmpeg for about $1,000.
- Some of the FFmpeg bugs were allegedly latent for 15 to 20 years, including one dating to 2003.
- Google's Chrome 149 fixed 429 vulnerabilities, the most in a single Chrome release.
- The worst Chrome bug was CVE-2026-10881, a sandbox-escape issue in ANGLE with a CVSS score of 9.6.
- The article argues that AI is accelerating bug discovery faster than patching and triage can keep up.
If the fixes are adopted quickly, FFmpeg users and Chrome users can close off dangerous bugs that have existed for years. The article also suggests AI can help security teams find serious flaws faster and produce reproducible proof-of-concepts that speed up repair work.
The bigger risk is that AI keeps flooding defenders with more vulnerabilities than they can triage, especially when many are buried in embedded copies and third-party bundles. The article also notes that much of the follow-up work still falls to volunteers and a thin layer of human triagers.
