Vulnerabilities · 94 days ago

AI Bug Hunts Are Swamping Human Triage

The bottleneck is shifting from finding bugs to absorbing them. Cheap AI runs can now hand defenders a stack of reproducible flaws faster than teams can verify impact, sort priority, and ship fixes, and that pressure hits hardest in widely embedded code that sits inside other products.

This week brought both sides of that shift. A security startup said an autonomous agent found 21 confirmed FFmpeg zero-days with reproducible proofs of concept for about $1,000 a run, while Google shipped Chrome 149 with 429 security fixes, the most ever in one release, after overhauling its bounty program to handle a flood of AI-generated reports. The point is not the exact count; it is the growing gap between vulnerability throughput and human response capacity.

CVE-2026-10881

NVD KEV

CVSS 9.6 CRITICAL: out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Microsoft patch: Release Notes.

Timeline

Jun 12 Reported by SecurityWeek
Jun 6 Reported by The Hacker News

Sources

2 sources covering this story

SecurityWeek Jun 12
Chrome 149 Update Patches 28 Vulnerabilities
The browser refresh resolved critical and high-severity security defects, including a dozen use-after-free bugs.
The Hacker News Jun 6
AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs
AI found 21 FFmpeg zero-days, some 20 years old; Chrome 149 patched 429 bugs, including 100+ critical/high flaws.
SecurityWeek Jun 5
Chrome 149 Patches 429 Vulnerabilities
Over 100 bugs are critical or high-severity, mainly use-after-free and insufficient validation of untrusted input flaws.

Part of the PlainSec briefing for 2026-06-07

Editions

Vulnerabilities · 94 days agoAI Bug Hunts Are Swamping Human TriageThe bottleneck is shifting from finding bugs to absorbing them. Cheap AI runs can now hand defenders a stack of reproducible flaws faster than teams can verify impact, sort priority, and ship fixes, and that pressure hits hardest in widely embedded code that sits inside other products.This week brought both sides of that shift. A security startup said an autonomous agent found 21 confirmed FFmpeg zero-days with reproducible proofs of concept for about $1,000 a run, while Google shipped Chrome 149 with 429 security fixes, the most ever in one release, after overhauling its bounty program to handle a flood of AI-generated reports. The point is not the exact count; it is the growing gap between vulnerability throughput and human response capacity.