AI Agent Finds 21 Zero-Days in FFmpeg for $1,000 — The Economics of Vulnerability Discovery Just Changed (opens in new tab)

TL;DR: Security startup depthfirst deployed an autonomous AI agent against FFmpeg's ~1.5 million lines of C code. The result: 21 confirmed zero-day vulnerabilities, each with a reproducible proof-of-concept, for approximately $1,000 in cloud compute costs. One critical finding — a stack overflow in the AV1 RTP depacketizer — is a network-reachable RCE exploitable with a single 183-byte RTP packet over RTSP. Nine CVEs have been assigned (CVE-2026-39210 through CVE-2026-39218). The discovery re...