Depthfirst's AI agent finds 21 zero-day bugs in FFmpeg for $1,000

Security startup depthfirst has reported a significant breakthrough: an autonomous AI agent identified 21 previously unknown zero-day vulnerabilities in FFmpeg, a widely used media library. The agent scanned approximately 1.5 million lines of C code at an estimated cost of $1,000, uncovering bugs that had remained latent for up to 23 years. The vulnerabilities include memory corruption and heap overflow issues, which are now being disclosed to FFmpeg maintainers. This achievement highlights the potential of AI-driven security testing to dramatically reduce both the cost and time required for vulnerability discovery, potentially outpacing traditional human-led audits.

Beyond the FFmpeg findings, depthfirst's approach suggests a new paradigm in cybersecurity: AI agents that can autonomously scan millions of lines of code, identify hidden flaws, and generate detailed reports without constant human oversight. For organizations using open-source libraries like FFmpeg, this could mean faster patching cycles and reduced risk of exploitation. However, it also raises ethical and defensive concerns—if AI can find vulnerabilities for $1,000, malicious actors could use similar tools to discover and weaponize zero-days at scale. depthfirst plans to release further technical details and hopes this inspires broader adoption of AI for proactive security auditing.