Depthfirst Claims 21 FFmpeg Zero-Days as AI Security Agents Chase Harder Targets

Depthfirst says its production autonomous security agent found 21 previously unknown vulnerabilities in FFmpeg, the open source media framework embedded across browsers, streaming systems, transcoding pipelines, surveillance tools, and media infrastructure. The claim matters less because another AI system found bugs, and more because of where it found them: FFmpeg is old, heavily fuzzed, written largely in C, and built around parsers for complex attacker-controlled media formats.

That makes it a useful test case for the security-agent market. A scanner that finds shallow issues in fresh web apps is not hard to sell. A system that can trace input through decades of optimized C, generate a concrete proof-of-concept file or packet, and separate reachable memory corruption from theoretical warnings is a more serious product claim.

Depthfirst says the run cost roughly $1,000, compared with about $10,000 Anthropic reportedly spent using its Mythos model on related FFmpeg research. No outside funding amount or named investors were disclosed in the material, so the traction signal here is technical rather than financial: 21 findings, eight assigned CVEs, fixed remaining issues, and a remote-code-execution primitive demonstrated against AV1-over-RTP handling.

The company is positioning itself in a crowded but still unsettled category: AI-assisted application security. The practical wedge is not another dashboard of possible bugs. The wedge is confirmed vulnerability discovery in software that already has years of expert attention behind it.

FFmpeg is an unusually valuable target because it sits at the edge of untrusted input. The FFmpeg source tree includes demuxers, muxers, codecs, protocol handlers, scaling code, command-line parsing, and network media logic. Many deployments do exactly what attackers want them to do: fetch media from a URL, parse it automatically, and transform it into another format. A single malformed stream can travel through protocol code, packet assembly, decoder state, and allocator behavior before anyone sees a visible error.

Depthfirst’s reported findings span that surface area. The disclosed CVEs include heap buffer overflows in the TS demuxer, yuv4mpegenc rawvideo path, VP9 decoder, DASH demuxer, and other components. There are also integer overflows, stack overflows, parser regressions, and long-dormant mistakes dating back as far as 2003 and 2005. The internal findings cover RTP AV1, RTP JPEG, RTP LATM, RTSP, RTMP, CAF, AVI, AVIF overlays, and FFmpeg option parsing.

The AV1 RTP issue is the most commercially interesting example because it shows what buyers of autonomous security tools actually care about: reachability, exploitability, and cost to validate. According to Depthfirst, the bug sits in libavformat/rtpdec_av1.c, where FFmpeg reconstructs AV1 video from RTP packets during normal RTSP playback. A victim only needs to open an attacker-controlled RTSP stream with a command like ffmpeg -i rtsp://attacker/stream.

The root cause is a broken invariant in packet assembly. FFmpeg tracks an output cursor, pktpos, as it writes reconstructed AV1 Open Bitstream Units into a packet buffer. Normal writes are preceded by calls that grow the packet allocation. Temporal Delimiter OBUs are special because the AV1 RTP payload format expects them to be ignored and removed. In the vulnerable path, FFmpeg advances pktpos by an attacker-controlled OBU size, but does not allocate matching memory and does not advance the input pointer.

That creates two useful attacker conditions. First, the next write begins at an offset beyond the allocation. Second, the skipped bytes can be reinterpreted as a new OBU, giving the attacker control over the bytes written out of bounds. Depthfirst describes a crafted 183-byte RTP packet that moves pktpos to offset 148, causes a smaller allocation, then writes attacker-controlled data beyond the end of the buffer.

The exploitability argument turns on FFmpeg’s allocator behavior. The packet buffer is followed by an AVBuffer bookkeeping structure containing a free function pointer. With the right offset, the overflow can overwrite that function pointer while leaving the reference count intact. A later buffer growth releases the corrupted buffer, causing FFmpeg to call the overwritten function pointer. Depthfirst reports redirecting execution to 0xdeadbeef in a release build, which is a proof of instruction-pointer control rather than just a crash.

This is where the security-agent story becomes more than model benchmarking. Many AI security demos still stop at plausible vulnerability reports. Those reports can be expensive for engineering teams because each suspected issue needs human validation. Depthfirst’s claim is that its agent produced reproducible proof-of-concept inputs, reducing the distance between automated reasoning and actionable remediation.

There is still reason to stay skeptical. FFmpeg is a famous target, and high-profile AI vulnerability claims can blur the line between rediscovery, variant analysis, and genuinely novel research. The meaningful details are the CVE assignments, fixes, reproducible inputs, and whether maintainers accepted the reports as real. On those measures, this looks more substantial than a generic AI security announcement.

For the market, the lesson is narrower than the marketing category suggests. Autonomous security agents are most credible when they are pointed at constrained technical domains with clear execution feedback: parsers, protocol handlers, codecs, compilers, file formats, kernels, and infrastructure written in memory-unsafe languages. In those environments, an agent can form a hypothesis, build or reuse a harness, generate malformed input, run the target, inspect the crash, and refine the case.

That workflow fits FFmpeg well. It may fit less cleanly in business-logic-heavy software, where correctness depends on product intent, authorization boundaries, billing rules, or internal policy. A security agent can still help there, but proof is harder. The strongest near-term opportunity is likely in codebases where failure is observable and adversarial inputs are easy to generate.

Depthfirst’s reported cost figure is also important. A $1,000 autonomous run that finds confirmed vulnerabilities in hardened open source is a different budget conversation than a $100,000 human audit or an open-ended bug bounty program. It does not replace either. Human researchers still decide severity, coordinate disclosure, reason about exploit chains, and design durable fixes. But it changes the economics of first-pass discovery, especially for companies maintaining large C and C++ attack surfaces.

For FFmpeg users, the operational takeaway is direct: treat media ingestion as untrusted-code exposure, not as a harmless conversion step. Services that accept user-supplied URLs, ingest RTSP feeds, transcode uploaded files, or process surveillance streams should track FFmpeg updates closely, isolate processing jobs, restrict network egress where possible, and run media workers with minimal privileges. The official FFmpeg documentation and download page remain the starting points for updates and build guidance.

For the startup ecosystem, Depthfirst’s announcement points to a sharper version of the AI security thesis. The value is not that an agent can read code. The value is that it can pick a high-risk surface, reason through attacker control, produce a concrete input, and keep false positives low enough that maintainers engage. That is a harder bar, and a better one.