What's this about?
Someone pointed an AI-written fuzzer at FFmpeg and it found a real bug: in the Sony PS2 VPK demuxer, `vpk_read_packet` divides by the channel count without checking it is non-zero. A crafted 21-byte file sets the channel count to zero and any FFmpeg-based application that opens it dies with SIGFPE. Rated medium severity. The header parser *does* validate the channel count — but in the fuzzer's custom I/O path the probe data and the later packet-read data can diverge, so the check is bypassed.
What is fuzzing, and what does "vibecoded" mean here?
Fuzzing is throwing malformed input at a program over and over to see what makes it crash — like shoving randomly shaped keys into a lock until one jams it. It is old, boring, effective security practice. "Vibecoded" means the fuzzer itself was written by prompting a model rather than by carefully engineering it. The interesting part is that fuzzing is unusually forgiving of low-quality tooling: the fuzzer does not need to be good, it just needs to produce one input that reproduces a crash.
What's the community saying?
- The framing most people accept: AI changes the economics of open-ended bug hunting. If a human wastes a week finding nothing that is expensive; if an agent does, it costs almost nothing.
- The counter-argument that gets the most replies: finding bugs with AI is the easy half. Reviewing the output, cleaning it up and making sure the fix doesn't break something else is the hard half.
- A rebuttal to that rebuttal: verification and adversarial review can also be done by models, leaving humans only the directional decisions — with agents pausing to pull a human in when an invariant is at stake.
- The uncomfortable version of the same thought, stated plainly: nobody can keep up with the volume of code AI produces, we will not stop using AI, so we will use AI to check AI.
- A sharper objection: what if finding and fixing are *inherently* asymmetric — models keep getting better at finding while staying bad at fixing anything non-trivial in a large codebase?
- One commenter offers the consolation that most of this is finding security issues in decades-old human-written code, and that supply eventually runs out.