A startup's autonomous AI agent found 21 zero-days in FFmpeg for ~$1,000. Meanwhile Chrome 149 patched a record 429 vulnerabilities in a single release.