21 Zero-Day Vulnerabilities Discovered in FFmpeg

depthfirst's Security Agent discovered 21 zero-day vulnerabilities in FFmpeg, a widely used media framework worldwide. This achievement surpasses the analysis performed by Google's Big Sleep and Anthropic's Mythos model.

This agent goes beyond simple code writing, incorporating a Threat Modeling stage that understands the codebase's architecture and maps the attack surface. Rather than merely reporting theoretical vulnerabilities, it automatically generates executable PoC (Proof of Concept) inputs to verify the actual reachability and reproducibility of vulnerabilities.

Key achievements include:

• Cost Efficiency: Found more vulnerabilities at approximately 10% of the cost ($1k) compared to the analysis performed by Anthropic using Mythos.
• Real-World Threats: Some of the discovered vulnerabilities had been latent for 15 to 20 years, and include primitives capable of RCE (Remote Code Execution).
• Automated Verification: The agent traces data flow to confirm whether attacker-controlled input reaches a vulnerable point (Sink), and has guardrails in place to prevent false positives.

These results demonstrate that AI agents can perform far more precise and economical security analysis than humans or general-purpose LLMs, even on highly optimized and complex large-scale C-language codebases.