AI Agent Finds 21 FFmpeg Zero-Days for $1,000, Intensifying Patch Pace

The rapid and low-cost discovery of critical vulnerabilities by AI agents in foundational software like FFmpeg indicates a fundamental shift in cybersecurity. This accelerates the need for streaming platforms and media companies to re-evaluate their patch management and software supply chain security. Organizations must prioritize continuous patching and security audits, as the window between vulnerability discovery and potential exploitation is shrinking. The focus for defense is now on remediation velocity and pipeline capacity, rather than just detection.

The increasing volume of AI-discovered vulnerabilities is a growing trend. Anthropic's Project Glasswing, for example, reported over 10,000 high- or critical-severity vulnerabilities across various open-source projects using their Claude Mythos Preview model, with 6,202 impacting over 1,000 open-source projects (per The CyberSignal, May 2026). Mozilla subsequently fixed 271 Firefox vulnerabilities identified by Mythos in a single release (per The CyberSignal, May 2026). Similarly, Cisco Talos disclosed four heap-based buffer overflow vulnerabilities in MediaInfoLib in May 2026, which is also a critical media analysis library, highlighting ongoing issues in multimedia processing software (per Talos Intelligence, May 2026). This surge in AI-driven vulnerability identification underscores that the security challenge is transitioning from bug discovery to efficient verification, disclosure, and patching, straining human-centric security pipelines, as acknowledged by Anthropic (per The CyberSignal, May 2026).