AI accelerates vulnerability hunting: FFmpeg hit by 21 Zero-days, Chrome patches record number of flaws

The cybersecurity world has just experienced a volatile week marked by two major events unfolding almost simultaneously. First, a technology security firm uncovered 21 previously unknown critical vulnerabilities in FFmpeg - the core video and image processing library powering most modern platforms. Remarkably, all of these flaws were automatically scanned and detected by an artificial intelligence (AI) agent.

Shortly after, Google turned heads by releasing Chrome 149, packed with patches for a staggering 429 security vulnerabilities - the largest record-breaking single-update patch in history.

AI uncovers flaws in the FFmpeg video library

The vulnerabilities discovered this time reside within FFmpeg, a foundational multimedia framework integrated into almost every piece of software or system that streams or plays video. The cybersecurity startup depthfirst deployed an AI agent to automatically audit roughly 1.5 million lines of the project's C source code.

The results were highly impressive: the AI discovered 21 zero-day vulnerabilities (critical flaws that had never been publicly disclosed), all accompanied by verifiable Proof-of-Concept (PoC) exploits. Notably, the operational cost for this AI-driven scan was a mere $1,000.

AI uncovers up to 21 zero-day vulnerabilities in the FFmpeg video library

Research indicates that many of these bugs had been "hiding" for decades, completely missed by conventional human-led security testing:

• Many flaws had existed silently for 15 to 20 years.

• Most notably, a critical memory-related flaw (stack overflow) within the service descriptor processing code had existed since 2003, meaning it remained hidden for 23 years without anyone noticing.

Technically, the majority of these flaws fall under memory-handling vulnerabilities (heap overflows or stack overflows), distributed across components ranging from the system data parser (TS demuxer) to the VP9 video decoder. Currently, several vulnerabilities have been assigned international identifiers (from CVE-2026-39210 to CVE-2026-39218), while the remaining flaws were promptly fixed by the development team before CVE IDs could even be assigned.

Chrome 149 and an unprecedented mass patch in history

At the same time, Google rolled out Chrome 149 to decisively address 429 security flaws. Among these, over 100 vulnerabilities were classified as high or critical severity, primarily consisting of use-after-free memory corruption and insufficient input validation issues.

• The most dangerous vulnerability: CVE-2026-10881, which received a near-perfect severity score of 9.6. This is an out-of-bounds read/write memory flaw within the ANGLE graphics engine. If attackers exploit this bug via a malicious website, they could break out of Chrome's sandbox defense mechanism to execute arbitrary malicious code directly on the user's computer. Google paid a $97,000 bug bounty reward to the researcher who discovered this flaw.

• Who found these flaws? Unlike FFmpeg, the vast majority of Chrome's critical vulnerabilities were audited and discovered by Google's own internal team (accounting for 19 out of 22 high-severity vulnerabilities, while external researchers contributed only 10 out of roughly 90 high-level bugs).

Although Google did not explicitly state whether this record-breaking 429-flaw count involved AI intervention, industry experts see a clear connection. Last April, Google completely overhauled its bug bounty program to cope with a wave of mass bug reports generated by AI. The new regulations force researchers to provide concise, actionable reproduction steps rather than the lengthy, boilerplate descriptions that AI can easily mass-produce.

The shift toward AI-driven vulnerability hunting

The integration of AI into the security landscape is no longer a futuristic concept; it is happening rapidly, as evidenced by a series of recent milestones:

• Previously, Google's AI tool named Big Sleep pointed out a series of bugs in FFmpeg (labeled BIGSLEEP on the project's security tracker).

• Anthropic's Mythos AI model uncovered a 16-year-old security flaw in the H.264 decoder along with other FFmpeg bugs, costing around $10,000 in operational overhead (three of which have been patched in FFmpeg 8.1).

• Recently, another automated tool scanned and uncovered an authenticated Remote Code Execution (RCE) vulnerability in the Redis database system - a flaw that had existed since version 7.2.0, remaining hidden for over two years.

AI is increasingly participating in the security race

A study published in February demonstrated the remarkable capability of this new technology: an AI agent could autonomously establish successful exploits for over half of 100 real-world Linux kernel vulnerabilities (Linux kernel N-day), vastly outperforming traditional automated testing methods like fuzzing.

What should users and system administrators do?

Faced with this rapid wave of vulnerability disclosures, both users and system engineers must proactively implement defense measures immediately:

• For FFmpeg: Upgrade immediately to the latest patched build from official upstream sources or your operating system's distribution channels. Systems handling untrusted media streams, such as RTSP or AV1-over-RTP, must be prioritized. Keep in mind that FFmpeg is often deeply embedded within Python wheels, container images, or specialized hardware appliances; therefore, a comprehensive audit and patch cycle are required rather than just updating base OS packages.

• For Google Chrome: Update to version 149.0.7827.53 (for Linux) or 149.0.7827.53/54 (for Windows and macOS). Users should double-check to ensure the browser's auto-update feature is functioning normally.

• Shift in administrative mindset: Incident response workflows must accelerate to keep pace with the times. Patch cycles need to be shortened, auto-updates amplified, and system upgrades tied to security patches (CVEs) must be prioritized as mission-critical security tasks rather than mere routine maintenance.

---

AI technology is making vulnerability discovery easier and more cost-effective than ever. However, this shifts the heaviest burden onto human shoulders. Triaging bug reports, developing patches, and distributing updates to end-users still heavily depend on engineers and open-source contributors. A lean workforce is currently strained to handle a massive volume of work moving at machine speed.