A neat pairing of two pressure fronts, with FFmpeg getting 21 reported zero-days from an autonomous agent and Chrome 149 landing a record 429 security fixes. The FFmpeg side has reproducer-backed parser bugs found for about $1,000, while Chrome is less an AI triumph than a giant patch-accounting exercise after a bounty-program rethink. Worth reading for the unglamorous bit, where discovery gets cheaper and the work of triage, release, and finding embedded copies refuses to become magical.