--- title: An AI agent found 21 zero-days in FFmpeg for $1,000.... description: A security startup called Depthfirst used an autonomous AI agent to discover 21 previously unknown zero-day vulnerabilities in FFmpeg — a widely used... canonical: https://daily.dev/posts/an-ai-agent-found-21-zero-days-in-ffmpeg-for-1-000-chrome-just-patched-a-record-429-bugs--loichspdc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: An AI agent found 21 zero-days in FFmpeg for $1,000. Chrome just patched a record 429 bugs. | daily.dev og:description: A security startup called Depthfirst used an autonomous AI agent to discover 21 previously unknown zero-day vulnerabilities in FFmpeg — a widely used... og:url: https://daily.dev/posts/an-ai-agent-found-21-zero-days-in-ffmpeg-for-1-000-chrome-just-patched-a-record-429-bugs--loichspdc og:image: https://api.daily.dev/og/posts/LoICHspDC.png og:image:alt: An AI agent found 21 zero-days in FFmpeg for $1,000. Chrome just patched a record 429 bugs. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # An AI agent found 21 zero-days in FFmpeg for $1,000. Chrome just patched a record 429 bugs. **[The Next Web](https://daily.dev/sources/tnw)** · 3 min read · 37 upvotes · 4 comments ## Summary A security startup called Depthfirst used an autonomous AI agent to discover 21 previously unknown zero-day vulnerabilities in FFmpeg — a widely used open-source media library — for roughly $1,000 in compute costs. Some bugs had existed in the codebase for over 20 years. Separately, Google shipped Chrome 149 with patches for a record 429 security bugs, over 100 of which are critical or high severity. The two events highlight a growing asymmetry: AI tools are finding vulnerabilities faster and cheaper than humans can triage and fix them. Other examples include an AI agent finding an RCE flaw in Redis and Mozilla patching 271 Firefox bugs found by Anthropic's Mythos model in a single pass. The core challenge has shifted from discovery to remediation — patching and deploying fixes at the pace AI can generate them. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@ivan0x9** · 0 upvotes > AI is finding bugs that were left behind years ago by ex-emplyees who couldn't figure out how to fix it and without documentations about them so that the next employees try solve them. That's the way I see it. I am semi-experienced with fixing legacy bugs from people that no longer worked in the company. **@ezee** · 0 upvotes > Sounds like some are new but some are the same ones that Mythos etc already found. ## Similar posts on daily.dev - [From Zero-Day to Zero-Hour: How AI Compresses the Vulnerability Lifecycle](https://daily.dev/posts/from-zero-day-to-zero-hour-how-ai-compresses-the-vulnerability-lifecycle-5dcwvg44s) · Security Boulevard · 1 upvotes · 0 comments - [AI Model Discovers 22 Firefox Vulnerabilities in Two Weeks](https://daily.dev/posts/ai-model-discovers-22-firefox-vulnerabilities-in-two-weeks-u6vsaoo3g) · InfoQ · 0 upvotes · 0 comments --- Tags: [#backend](https://daily.dev/tags/backend), [#vulnerability](https://daily.dev/tags/vulnerability), [#google-chrome](https://daily.dev/tags/google-chrome), [#ai-security](https://daily.dev/tags/ai-security), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/an-ai-agent-found-21-zero-days-in-ffmpeg-for-1-000-chrome-just-patched-a-record-429-bugs--loichspdc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"An AI agent found 21 zero-days in FFmpeg for $1,000. Chrome just patched a record 429 bugs.","url":"https://daily.dev/posts/an-ai-agent-found-21-zero-days-in-ffmpeg-for-1-000-chrome-just-patched-a-record-429-bugs--loichspdc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/an-ai-agent-found-21-zero-days-in-ffmpeg-for-1-000-chrome-just-patched-a-record-429-bugs--loichspdc"},"datePublished":"2026-06-06T13:04:30.295Z","dateModified":"2026-06-06T13:04:53.533Z","description":"A security startup called Depthfirst used an autonomous AI agent to discover 21 previously unknown zero-day vulnerabilities in FFmpeg — a widely used...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e84185b0797825c555489af3e5f642ee?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e84185b0797825c555489af3e5f642ee?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":4,"discussionUrl":"https://daily.dev/posts/an-ai-agent-found-21-zero-days-in-ffmpeg-for-1-000-chrome-just-patched-a-record-429-bugs--loichspdc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":37},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":4}],"keywords":"backend,vulnerability,google-chrome,ai-security,zero-day","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"An AI agent found 21 zero-days in FFmpeg for $1,000. Chrome just patched a record 429 bugs."}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/an-ai-agent-found-21-zero-days-in-ffmpeg-for-1-000-chrome-just-patched-a-record-429-bugs--loichspdc","comment":[{"@type":"Comment","text":"AI is finding bugs that were left behind years ago by ex-emplyees who couldn’t figure out how to fix it and without documentations about them so that the next employees try solve them. That’s the way I see it. I am semi-experienced with fixing legacy bugs from people that no longer worked in the company.","datePublished":"2026-06-11T08:51:28.909Z","url":"https://daily.dev/posts/LoICHspDC#c-TdkYMmTla","author":{"@type":"Person","name":"Ivan Mršić","url":"https://daily.dev/ivan0x9","image":"https://media.daily.dev/image/upload/s--pBWsDcTy--/f_auto/v1768396755/avatars/avatar_irmdLljsvSnDMcVzPGDBN?_a=BAMAMiZW0"}},{"@type":"Comment","text":"Sounds like some are new but some are the same ones that Mythos etc already found.","datePublished":"2026-06-12T21:06:10.712Z","url":"https://daily.dev/posts/LoICHspDC#c-ovmAjMvQz","author":{"@type":"Person","name":"E","url":"https://daily.dev/ezee","image":"https://media.daily.dev/image/upload/s--fCfktlbR--/f_auto/v1767451916/avatars/avatar_93JdfDmXtcEWkGXSGC1ne?_a=BAMAK+ZW0"}}]} ```