YFarmX AI-Found Vulnerability RegisterNew entries on the YFarmX AI-Found Vulnerability Register: every vulnerability credited to an AI finder, with the evidence tier, the credit as recorded and the source on every entry.https://yfarmx.com/en-GBGoogle OSS-Fuzz-Gen reports 30 new bugs found by automatically generated fuzz targetshttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0060/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0060/The README table lists 23 named-project rows and seven undisclosed rows, two of them pending maintainer triage, totalling the 30 it claims. One entry carries a CVE, CVE-2024-9143, which is its own row here.Sat, 12 Sep 2026 00:00:00 GMTGoogle OSS-Fuzz-GenaggregateCONFIRMEDAnthropic reports an autonomous exploit workflow yielding more than a dozen possible zero-days in a monthhttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0066/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0066/Anthropic's September 2026 threat report describes an exploit foundry that ran firmware decryption through a decompiler tool server to tested exploit code, with findings the actor kept. "Possible" is the report's own word.Wed, 09 Sep 2026 00:00:00 GMTGTG-10007 exploit workflow (threat actor)aggregateCONFIRMEDChrome V8 out-of-bounds write exploited in the wild, found by a human researcher and paid $2,500 (the control row)https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0047/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0047/Fixed in Chrome 153.0.8010.36 on 8 September 2026 and exploited in the wild by a third party. The row sits in the register as a control: headlines conflated it with an AI-derived exploit chain built on 3 September, and the release note credits a person, with a $2,500 reward.Tue, 08 Sep 2026 00:00:00 GMTJihyeon Jeong (human researcher)cna-advisoryCONFIRMEDWebKitGTK memory corruption in OpenTypeVerticalData, found by Google Big Sleephttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0018/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0018/A memory corruption in WebKitGTK from 1.10.0, assigned by Red Hat on 31 August 2026 with a Big Sleep acknowledgement, the newest Big Sleep record in the register.Mon, 31 Aug 2026 00:00:00 GMTGoogle Big Sleepcredits-arrayCONFIRMEDAnthropic attributes 500 or more high-severity vulnerabilities that survived decades of scrutiny to Claude Opushttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0068/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0068/A separate figure from the Glasswing count, filed under Claude Opus rather than Mythos, with no identifier list.Fri, 21 Aug 2026 00:00:00 GMTClaude Opus (Anthropic)aggregateCONFIRMEDAnthropic says Project Glasswing partners found more than 10,000 high- or critical-severity flawshttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0067/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0067/On 2 June 2026 Anthropic said it was extending Glasswing to about 150 more organisations and that partners had by then found more than 10,000 high- or critical-severity flaws. No identifier list accompanies the figure.Tue, 02 Jun 2026 00:00:00 GMTClaude Mythos Preview and Mythos 5 (Project Glasswing)aggregateCONFIRMEDdepthfirst reports 21 FFmpeg zero-days from a $1,000 scan of 1.5 million lineshttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0061/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0061/Opened on 19 September 2026: the page dates itself 2 June 2026, names nine CVE identifiers and twelve DFVULN identifiers, and says the twelve are fixed with no CVE assigned yet. The most severe, DFVULN-127, is described as a heap buffer overflow in the AV1 RTP depacketizer reachable from one 183-byte packet.Tue, 02 Jun 2026 00:00:00 GMTdepthfirst autonomous security agentaggregateCONFIRMEDFFmpeg heap overflow in the DASH demuxer, claimed by depthfirst under an identifier the CVE list does not yet servehttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0056/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0056/One of nine identifiers depthfirst quotes for its FFmpeg run, which scanned roughly 1.5 million lines of C for about $1,000 and reported 21 zero-days. The write-up says nine "have already been assigned CVEs"; the CVE Program's own list answered 404 for every one on 12 September and again on 19 September 2026, so the row stands as a claim until a record serves.Tue, 02 Jun 2026 00:00:00 GMTdepthfirst autonomous security agentclaimedUNVERIFIEDFFmpeg memory safety in the FFmpeg component per the write-up, claimed by depthfirst under an identifier the CVE list does not yet servehttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0055/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0055/One of nine identifiers depthfirst quotes for its FFmpeg run, which scanned roughly 1.5 million lines of C for about $1,000 and reported 21 zero-days. The write-up says nine "have already been assigned CVEs"; the CVE Program's own list answered 404 for every one on 12 September and again on 19 September 2026, so the row stands as a claim until a record serves.Tue, 02 Jun 2026 00:00:00 GMTdepthfirst autonomous security agentclaimedUNVERIFIEDFFmpeg memory safety in the FFmpeg component per the write-up, claimed by depthfirst under an identifier the CVE list does not yet servehttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0054/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0054/One of nine identifiers depthfirst quotes for its FFmpeg run, which scanned roughly 1.5 million lines of C for about $1,000 and reported 21 zero-days. The write-up says nine "have already been assigned CVEs"; the CVE Program's own list answered 404 for every one on 12 September and again on 19 September 2026, so the row stands as a claim until a record serves.Tue, 02 Jun 2026 00:00:00 GMTdepthfirst autonomous security agentclaimedUNVERIFIEDFFmpeg memory safety in the FFmpeg component per the write-up, claimed by depthfirst under an identifier the CVE list does not yet servehttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0053/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0053/One of nine identifiers depthfirst quotes for its FFmpeg run, which scanned roughly 1.5 million lines of C for about $1,000 and reported 21 zero-days. The write-up says nine "have already been assigned CVEs"; the CVE Program's own list answered 404 for every one on 12 September and again on 19 September 2026, so the row stands as a claim until a record serves.Tue, 02 Jun 2026 00:00:00 GMTdepthfirst autonomous security agentclaimedUNVERIFIEDFFmpeg memory safety in the FFmpeg component per the write-up, claimed by depthfirst under an identifier the CVE list does not yet servehttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0052/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0052/One of nine identifiers depthfirst quotes for its FFmpeg run, which scanned roughly 1.5 million lines of C for about $1,000 and reported 21 zero-days. The write-up says nine "have already been assigned CVEs"; the CVE Program's own list answered 404 for every one on 12 September and again on 19 September 2026, so the row stands as a claim until a record serves.Tue, 02 Jun 2026 00:00:00 GMTdepthfirst autonomous security agentclaimedUNVERIFIEDFFmpeg memory safety in the FFmpeg component per the write-up, claimed by depthfirst under an identifier the CVE list does not yet servehttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0051/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0051/One of nine identifiers depthfirst quotes for its FFmpeg run, which scanned roughly 1.5 million lines of C for about $1,000 and reported 21 zero-days. The write-up says nine "have already been assigned CVEs"; the CVE Program's own list answered 404 for every one on 12 September and again on 19 September 2026, so the row stands as a claim until a record serves.Tue, 02 Jun 2026 00:00:00 GMTdepthfirst autonomous security agentclaimedUNVERIFIEDFFmpeg memory safety in the FFmpeg component per the write-up, claimed by depthfirst under an identifier the CVE list does not yet servehttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0050/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0050/One of nine identifiers depthfirst quotes for its FFmpeg run, which scanned roughly 1.5 million lines of C for about $1,000 and reported 21 zero-days. The write-up says nine "have already been assigned CVEs"; the CVE Program's own list answered 404 for every one on 12 September and again on 19 September 2026, so the row stands as a claim until a record serves.Tue, 02 Jun 2026 00:00:00 GMTdepthfirst autonomous security agentclaimedUNVERIFIEDFFmpeg integer overflow in the swscale, claimed by depthfirst under an identifier the CVE list does not yet servehttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0049/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0049/One of nine identifiers depthfirst quotes for its FFmpeg run, which scanned roughly 1.5 million lines of C for about $1,000 and reported 21 zero-days. The write-up says nine "have already been assigned CVEs"; the CVE Program's own list answered 404 for every one on 12 September and again on 19 September 2026, so the row stands as a claim until a record serves.Tue, 02 Jun 2026 00:00:00 GMTdepthfirst autonomous security agentclaimedUNVERIFIEDFFmpeg heap overflow in the MPEG-TS demuxer, claimed by depthfirst under an identifier the CVE list does not yet servehttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0048/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0048/One of nine identifiers depthfirst quotes for its FFmpeg run, which scanned roughly 1.5 million lines of C for about $1,000 and reported 21 zero-days. The write-up says nine "have already been assigned CVEs"; the CVE Program's own list answered 404 for every one on 12 September and again on 19 September 2026, so the row stands as a claim until a record serves.Tue, 02 Jun 2026 00:00:00 GMTdepthfirst autonomous security agentclaimedUNVERIFIEDGoogle CodeMender upstreamed 72 security fixes in its first six monthshttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0069/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0069/CodeMender fixes rather than finds: 72 security patches upstreamed over six months, each human-reviewed, with the model inside the harness moving from Gemini Deep Think to Gemini 3.5 Flash Cyber and then 3.8 Flash Cyber.Mon, 11 May 2026 00:00:00 GMTGoogle CodeMenderaggregateSINGLEGogs unauthenticated file upload, disclosed by OpenAI Security Researchhttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0030/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0030/An unauthenticated file upload in Gogs, advisory published 17 February 2026 and CVE record 19 February, whose disclosure header dates the discovery to 5 August 2025, three months before OpenAI announced Aardvark.Thu, 19 Feb 2026 00:00:00 GMTOpenAI Aardvarkcna-advisoryCONFIRMEDGogs two-factor bypass via recovery code, disclosed by OpenAI Security Researchhttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0029/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0029/A two-factor bypass in Gogs published 6 February 2026 with GitHub as CNA, whose advisory text names OpenAI Security Research as the discloser.Fri, 06 Feb 2026 00:00:00 GMTOpenAI Aardvarkcna-advisoryCONFIRMEDAISLE claims more than 225 CVEs across OpenSSL, the Linux kernel, curl, Apache, Mozilla, Redis and Elastichttps://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0062/https://yfarmx.com/tools/ai-found-vulnerabilities/aifv-0062/AISLE says it holds all twelve CVEs in the OpenSSL release of 27 January 2026, credit on 13 of 14 OpenSSL CVEs assigned in 2025, three of the six CVEs fixed in curl 8.18.0, and more than 225 CVEs in total. That last figure would make it the largest contributor here by an order of magnitude and rests on the company's own pages.Tue, 27 Jan 2026 00:00:00 GMTAISLEaggregateSINGLE