{"id":2989,"date":"2025-11-13T18:53:05","date_gmt":"2025-11-14T01:53:05","guid":{"rendered":"https:\/\/catbradley.io\/?p=2989"},"modified":"2025-11-13T18:53:05","modified_gmt":"2025-11-14T01:53:05","slug":"ffmpeg-calls-googles-ai-bug-reports-cve-slop","status":"publish","type":"post","link":"https:\/\/catbradley.io\/?p=2989","title":{"rendered":"FFmpeg Calls Google’s AI Bug Reports “CVE Slop”"},"content":{"rendered":"

\"FFmpeg<\/p>\n

FFmpeg<\/a> maintainers have publicly criticized Google after its AI tool reported a security bug in code for a 1995 video game.<\/p>\n

The maintainers called the finding “CVE slop<\/a>” and questioned whether trillion-dollar corporations should use AI to find security issues in volunteer code without providing fixes.<\/p>\n

Unchecked Automation is Not an Answer<\/h2>\n
\n
\n

Patch to fix an issue with decoding LucasArts Smush codec, specifically the first 10-20 frames of Rebel Assault 2, a game from 1995.<\/p>\n

FFmpeg aims to play every video file ever made. pic.twitter.com\/9WryDgDpER<\/a><\/p>\n

\u2014 FFmpeg (@FFmpeg) October 30, 2025<\/a><\/p><\/blockquote>\n<\/figure>\n

So what happened is<\/strong>, Google’s AI agent Big Sleep found a bug<\/a> in FFmpeg’s code for decoding LucasArts Smush codec. The issue affected the first 10-20 frames of Rebel Assault II<\/a>, a game from 1995.<\/p>\n

If you didn’t know, Big Sleep<\/a> is Google’s AI-powered vulnerability detection tool developed by its Project Zero and DeepMind divisions. It is supposed to find security vulnerabilities in software before attackers can exploit them.<\/p>\n

But there’s an issue here: under Google’s “Reporting Transparency<\/a>” policy, the tech giant publicly announces it has found a vulnerability within one week of reporting it. A 90-day disclosure clock then starts regardless of whether a patch is available.<\/p>\n

You see the problem now? <\/em>\ud83e\udd14<\/p>\n

FFmpeg developers patched the bug but weren’t happy about it. They tweeted in late October<\/a> that “We take security very seriously but at the same time is it really fair that trillion-dollar corporations run AI to find security issues in people’s hobby code? Then expect volunteers to fix<\/em>.”<\/p>\n

Beyond that, you have to understand that FFmpeg is an important piece of digital infrastructure<\/strong> that is used in Google Chrome, Firefox, YouTube, VLC, Kodi, and many other platforms.<\/p>\n

The project is written almost exclusively by volunteers. Much of the code is in assembly language<\/a>, which is difficult to work with. This situation basically highlights the ongoing tensions<\/a> over how corporations use volunteer-maintained open source software that powers their commercial products and expect them to fix any obscure issues that crop up.<\/p>\n

Via: The New Stack<\/a><\/p>\n

Suggested Reads \ud83d\udcd6<\/strong><\/p>\n

\n
\n
Open Source Infrastructure is Breaking Down Due to Corporate Freeloading<\/div>\n
An unprecedented threat looms over open source.<\/div>\n
\"FFmpegIt’s FOSS<\/span>Sourav Rudra<\/span><\/div>\n<\/div>\n
\"FFmpeg<\/div>\n

<\/p><\/a><\/figure>\n

\n
\n
FFmpeg Receives $100K in Funding from India\u2019s FLOSS\/fund Initiative<\/div>\n
It is one of the world\u2019s most widely used multimedia frameworks today.<\/div>\n
\"FFmpegIt’s FOSS<\/span>Sourav Rudra<\/span><\/div>\n<\/div>\n
\"FFmpeg<\/div>\n

<\/p><\/a><\/figure>","protected":false},"excerpt":{"rendered":"

FFmpeg maintainers have publicly criticized Google after its AI tool reported a security bug in code for a 1995 video game. The maintainers called the finding “CVE slop” and questioned…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2989","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-rss"],"_links":{"self":[{"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/posts\/2989","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/catbradley.io\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2989"}],"version-history":[{"count":0,"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/posts\/2989\/revisions"}],"wp:attachment":[{"href":"https:\/\/catbradley.io\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2989"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/catbradley.io\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2989"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/catbradley.io\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2989"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}