A security startup's autonomous AI agent swept through FFmpeg and turned up 21 previously unknown vulnerabilities for roughly $1,000 in compute.
The startup, depthfirst, set an AI agent loose on FFmpeg, the open-source media library that processes video inside browsers, streaming platforms, editing suites, and just about anything else that touches a video file. The agent found 21 zero-days. Some had been sitting undetected in the codebase for more than 20 years. Days later, Google shipped a Chrome update patching a record 429 bugs, a reminder that the industry's backlog of undiscovered vulnerabilities is not a small number.
The cost is the real story: traditional security audits of a codebase this size run into tens or hundreds of thousands of dollars, and $1,000 changes who can afford to look. That cuts both ways; defenders can sweep more code faster, but so can anyone with a cloud account and an API key, and FFmpeg's reach into Chrome, VLC, and virtually every tool that handles video means these holes were never purely theoretical.
The 20-year-old bugs aren't an indictment of FFmpeg's maintainers; they're what happens when a large C codebase outlives the security tooling that existed when it was written, and the more pressing question now is whether responsible disclosure moves faster than the next AI-assisted sweep.