> ## Content Index
> Fetch the complete content index at: https://itsfoss.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# FFmpeg Calls Google's AI Bug Reports "CVE Slop"
- URL: https://itsfoss.com/news/ffmpeg-google-fiasco/
- Published: 2025-11-14T01:53:05.000Z
- Updated: 2025-11-14T01:53:05.000Z
- Description: Open source project pushes back on AI-generated vulnerability reports.
- Author: Sourav Rudra
- Tags: News

[FFmpeg](https://www.ffmpeg.org/?ref=itsfoss.com) maintainers have publicly criticized Google after its AI tool reported a security bug in code for a 1995 video game.

The maintainers called the finding "[CVE slop](https://x.com/ffmpeg/status/1984207514389586050?ref=itsfoss.com)" and questioned whether trillion-dollar corporations should use AI to find security issues in volunteer code without providing fixes.

## Unchecked Automation is Not an Answer

> Patch to fix an issue with decoding LucasArts Smush codec, specifically the first 10-20 frames of Rebel Assault 2, a game from 1995.  
>  
> FFmpeg aims to play every video file ever made. [pic.twitter.com/9WryDgDpER](https://t.co/9WryDgDpER?ref=itsfoss.com)
> 
> — FFmpeg (@FFmpeg) [October 30, 2025](https://twitter.com/FFmpeg/status/1983949866725437791?ref%5Fsrc=twsrc%5Etfw&ref=itsfoss.com)

**So what happened is**, Google's AI agent Big Sleep found [a bug](https://x.com/FFmpeg/status/1983949866725437791?ref=itsfoss.com) in FFmpeg's code for decoding LucasArts Smush codec. The issue affected the first 10-20 frames of [Rebel Assault II](https://en.wikipedia.org/wiki/Star%5FWars:%5FRebel%5FAssault%5FII:%5FThe%5FHidden%5FEmpire?ref=itsfoss.com), a game from 1995.

If you didn't know, [Big Sleep](https://googleprojectzero.blogspot.com/2024/10/from-naptime-to-big-sleep.html?ref=itsfoss.com) is Google's AI-powered vulnerability detection tool developed by its Project Zero and DeepMind divisions. It is supposed to find security vulnerabilities in software before attackers can exploit them.

But there's an issue here: under Google's "[Reporting Transparency](https://googleprojectzero.blogspot.com/2025/07/reporting-transparency.html?ref=itsfoss.com)" policy, the tech giant publicly announces it has found a vulnerability within one week of reporting it. A 90-day disclosure clock then starts regardless of whether a patch is available.

*You see the problem now?* 🤔

FFmpeg developers patched the bug but weren't happy about it. They tweeted in [late October](https://x.com/FFmpeg/status/1984178359354483058?ref=itsfoss.com) that "*We take security very seriously but at the same time is it really fair that trillion-dollar corporations run AI to find security issues in people's hobby code? Then expect volunteers to fix*."

Beyond that, you have to understand that **FFmpeg is an important piece of digital infrastructure** that is used in Google Chrome, Firefox, YouTube, VLC, Kodi, and many other platforms.

The project is written almost exclusively by volunteers. Much of the code is in [assembly language](https://en.wikipedia.org/wiki/Assembly%5Flanguage?ref=itsfoss.com), which is difficult to work with. This situation basically highlights [the ongoing tensions](https://itsfoss.com/news/open-source-infrastructure-is-breaking-down/) over how corporations use volunteer-maintained open source software that powers their commercial products and expect them to fix any obscure issues that crop up.

Via: [The New Stack](https://thenewstack.io/ffmpeg-to-google-fund-us-or-stop-sending-bugs/?ref=itsfoss.com)

**Suggested Reads 📖**

[Open Source Infrastructure is Breaking Down Due to Corporate FreeloadingAn unprecedented threat looms over open source.![](https://itsfoss.com/content/images/icon/android-chrome-512x512-20.png)It's FOSSSourav Rudra![](https://itsfoss.com/content/images/thumbnail/openssf-letter-to-big-corporations-2.png)](https://itsfoss.com/news/open-source-infrastructure-is-breaking-down/)

[FFmpeg Receives $100K in Funding from India’s FLOSS/fund InitiativeIt is one of the world’s most widely used multimedia frameworks today.![](https://itsfoss.com/content/images/icon/android-chrome-512x512-19.png)It's FOSSSourav Rudra![](https://itsfoss.com/content/images/thumbnail/ffmpeg-funding-floss-fund.png)](https://itsfoss.com/news/ffmpeg-receives-100k-funding/)