tech
An AI agent found 21 zero-days in FFmpeg for $1,000. Chrome just patched a record 429 bugs.
Depthfirst’s AI agent found 21 FFmpeg zero-days for $1,000. Chrome 149 patched a record 429 bugs. AI is flooding defenders with more bugs than they can handle.
TL;DR
- Depthfirst's AI agent discovered 21 zero-day vulnerabilities in FFmpeg for an estimated $1,000.
- Some of these FFmpeg bugs had remained undiscovered for more than 20 years.
- Google's Chrome 149 update included patches for a record 429 security bugs.
- AI is accelerating vulnerability discovery, creating a challenge for developers to keep up with fixes.
- The cost of finding bugs is decreasing due to AI, but the effort required for triaging, fixing, and deployment remains high.
- A severe bug in Chrome 149 allowed for potential sandbox escape and host code execution, for which Google paid $97,000.