FFmpeg maintainers have voiced strong criticism of Google’s AI tool, Big Sleep, after it reported a security vulnerability in obsolete video game codec code without proposing any fixes. This situation underscores ongoing tensions between volunteer-run open source projects and large corporations that leverage these projects in commercial applications.
The disagreement centers on Google’s policy of publicly announcing vulnerabilities shortly after they are discovered and initiating a 90-day countdown for disclosure, regardless of whether a patch is available. This approach places a significant burden on volunteer developers, who are then responsible for addressing complex and often obscure security issues that affect vital infrastructure, which underpins major platforms like Chrome, Firefox, and YouTube.
In their reaction, FFmpeg developers have called on Google to provide financial support or cease offloading the responsibility of fixing such bugs onto unpaid volunteers. This contention is part of a larger crisis in the open-source ecosystem, where essential projects such as FFmpeg and libxml2 depend heavily on volunteer efforts, while tech behemoths derive substantial benefits without offering adequate financial backing.
The debate further extends to the impact of Google’s AI-powered vulnerability detection methods, which allegedly create unsustainable workloads for maintainers. This pressure has already led to significant developments, such as the resignation of libxml2’s lead developer. Advocates argue that instead of merely identifying vulnerabilities, corporations should either submit patches alongside their bug reports or provide direct funding to the projects. This approach could help balance the scales and ensure that volunteers are not left grappling with intricate assembly-level security challenges in outdated code unassisted.

Collections

FFmpeg maintainers criticized Google's Big Sleep AI tool for reporting a security vulnerability in obsolete code without providing fixes or financial support. The conflict highlights tensions in open source sustainability, where volunteer-maintained projects like FFmpeg power major commercial platforms but receive inadequate backing from corporations. FFmpeg developers demand that companies either contribute patches with vulnerability reports or provide direct funding, rather than imposing 90-day disclosure deadlines that burden unpaid maintainers with complex security work.

FFmpeg Criticizes Google's AI Vulnerability Reporting Without Support