An AI Agent Found 21 Zero-Days in FFmpeg for $1,000 — One Is a Network-Reachable RCE via a Single 183-Byte Packet
Summary
An autonomous AI agent from depthfirst discovered 21 zero-day vulnerabilities in FFmpeg, including a network-reachable RCE via a single 183-byte packet, for only $1,000 in compute costs; the find highlights the disparity between automated bug finding and patching.
Similar Articles
Twenty One Zero-Days in FFmpeg
depthfirst's autonomous security agent discovered 21 zero-day vulnerabilities in FFmpeg, including several that had remained latent for 15-20 years, with a proof-of-concept demonstrating remote code execution. The findings highlight the capability of AI-driven security agents to uncover critical bugs that evaded previous intensive analyses by Google and Anthropic.
We found a division by zero bug in FFmpeg with a vibecoded fuzzer
A division by zero vulnerability was identified in the FFmpeg multimedia tool through the use of a custom fuzzer, as reported in a software issue.
How one hacker used AI agents and a few thousand dollars to break into scores of sites
A hacker reportedly used AI agents and a modest budget to discover and exploit vulnerabilities across dozens of websites, highlighting both the power and risks of AI-driven offensive security.
@stanislavfort: My AI security research lab AISLE discovered 500+ zero-days with CVEs across 100+ codebases in a year => ~1% of 2026's …
Stanislav Fort's AI security research lab AISLE claims to have discovered 500+ zero-day vulnerabilities with CVEs across 100+ codebases in a year, roughly 1% of 2026's global open-source CVEs, while matching or outperforming frontier AI labs on hardened codebases like curl.
@seclink: 1. Agent security has evolved from an academic topic to an industry reality: FFmpeg zero-day ($1,000 cost) + Chrome 429 patch + OpenAI Lockdown Mode + OWASP framework — the security supply chain is being reshaped by AI Agents. 2.…
AI Agent security has moved from an academic topic to an industry reality, involving FFmpeg zero-day vulnerabilities, Chrome 429 patch, OpenAI Lockdown Mode, and the OWASP framework; meanwhile, Agent payment standards are becoming a battlefield for infrastructure, with Visa stablecoin settlement competing with traditional card networks.