Category: Security | Reading time: 6 min
The Finding
DepthFirst's autonomous security agent scanned 1.5 million lines of C code in the FFmpeg library and surfaced 21 confirmed zero-day vulnerabilities.
Some of the bugs it found had existed in the codebase for 20 years, surviving decades of human security review.
The total cost of the discovery was approximately $1,000.
The finding was not a demonstration of a research capability. It was a production run of an autonomous agent doing security research at a cost structure that makes the same capability accessible to any attacker with a credit card.
The Chrome Response
Shortly after the DepthFirst finding was published, Google released Chrome 149 with a record 429 patches in a single release.
Among them was CVE-2026-10881, rated CVSS 9.6, for which Google paid the discovering researcher $97,000.
The scale of the Chrome 149 patch release reflects the volume of vulnerability research being produced by autonomous agents and the acceleration of the vulnerability discovery cycle.
28.3 percent of CVEs are now exploited within 24 hours of public disclosure according to Mandiant M-Trends 2026. The window between discovery and weaponization has collapsed.
The Attacker Economics
The $1,000 cost for 21 zero-days represents a fundamental shift in attacker economics.
Zero-day vulnerability research has historically been expensive, requiring skilled human researchers working for weeks or months. The cost floor for serious vulnerability discovery was in the tens of thousands of dollars at minimum.
DepthFirst's result suggests that floor has dropped by one to two orders of magnitude.
At $1,000 per engagement, offensive AI security research is within the budget of organized criminal groups, nation-state proxies, insider threats, and individual attackers with modest funding.
The Dual Use Problem
The same autonomous agent capability that DepthFirst used to find vulnerabilities and responsibly disclose them can be used to find vulnerabilities and exploit them.
The research methodology, the tooling, and the cost structure are identical. The difference is the intent of the operator.
Defense teams using autonomous agents for security research are racing against attackers using the same capability for exploitation.
The research cycle that used to favor defenders because of cost and expertise requirements no longer does.
What This Means for Agent Security
The DepthFirst finding has a direct implication for the security of AI agent infrastructure itself.
If autonomous agents can scan millions of lines of code for vulnerabilities at $1,000 per engagement, the attack surface of every agent framework, every orchestration platform, and every identity management system deployed in enterprise environments is under continuous autonomous security research by potential adversaries.
The 40+ CVEs filed against MCP implementations in the first four months of 2026 are consistent with this assessment.
The vulnerability discovery rate for critical agent infrastructure is going to increase, not decrease.
The Enforcement Layer Response
The correct response to a vulnerability environment where exploitation can follow disclosure by hours is not to patch faster. Patch cycles cannot compress to match the 24-hour exploitation window that Mandiant documented.
The response is to enforce what agents can do at the execution layer so that a compromised infrastructure component cannot produce agent behavior outside the authorized scope.
An agent with a verified identity, behavioral enforcement, and a signed audit trail at every action is not immune to the vulnerabilities in the infrastructure it runs on. But the blast radius of any exploitation is bounded by what the agent was authorized to do.
That boundary is the defense that patch velocity cannot provide.
Sources: DepthFirst Zero-Day Research Coverage and Mandiant M-Trends 2026 Exploitation Timeline