AI agent finds 21 FFmpeg zero-days: Europe's open-source risk

Samantha: Welcome to The State of Tech, The European Edition, Sunday June seven, 2026. I'm Samantha Lawrence.

Bob: And I'm Bob Russell. Today: an AI agent uncovers twenty-one zero-day flaws in software running inside almost every video app on the planet; Apple gets ready to overhaul Siri at its big developer conference tomorrow; ChatGPT crosses one billion monthly users; China cements its grip on the parts that keep global AI running; the world's first AI-designed cancer vaccine enters human trials; and to close out, two things you can actually use today, the autonomous lab platform from Ginkgo Bioworks, and Apple Wallet's new scan-to-add feature. Let's start with that cybersecurity bombshell.

An autonomous AI agent uncovers twenty-one zero-day flaws in FFmpeg, the media library inside almost every video app.

Samantha: We're starting with a story that should make every European security team sit up. A small startup called depthfirst says its autonomous AI agent has found twenty-one previously unknown vulnerabilities in FFmpeg. Some of these flaws have apparently been sitting in the code for fifteen to twenty years.

Bob: And FFmpeg matters because it's almost invisible infrastructure. It's the open-source library that handles video and audio inside a huge range of apps, from streaming services to video editors to security cameras. If you've watched a clip on your phone today, FFmpeg was very likely involved somewhere in the chain.

Samantha: The agent didn't just flag suspicious code. It scanned the whole codebase, mapped out where memory could be corrupted, and produced working proof-of-concept exploits. That's the bit that changes the game. Finding bugs at machine speed is one thing, weaponising them is another.

Bob: And it lands in the same week that Google's Chrome 149 shipped a record four hundred and twenty-nine security patches. Google has been open about the fact that AI-assisted discovery is part of why that number keeps climbing.

Samantha: So we're seeing both sides of the same shift. Defenders are using AI to find more flaws faster, but attackers can use exactly the same techniques. And the patching process on the other end is still mostly human, slow, and dependent on volunteer maintainers.

Bob: For Europe this is the awkward part. A lot of critical software in hospitals, broadcasters and government services leans on open-source libraries like FFmpeg, maintained by very small teams. The EU's Cyber Resilience Act already pushes vendors to take responsibility for the components they ship, but it doesn't magically create more maintainers.

Samantha: The bottom line is the discovery curve is bending steeply upward, and Europe's defence side has to bend with it. Expect more pressure for AI-enabled patch management, and more questions about who actually funds the open-source plumbing that everything else runs on.

Apple is set to unveil a major AI-powered Siri overhaul and new ecosystem features at WWDC tomorrow.

Bob: Moving on to Cupertino. Apple's Worldwide Developers Conference kicks off tomorrow, and the leaks are pointing to the biggest Siri overhaul in years. The picture from multiple sources is that Siri is being rebuilt as an open AI assistant, able to plug into different underlying AI models rather than relying purely on Apple's own.

Samantha: Which is a real change of philosophy. For a long time Apple kept its assistant tightly walled off. Now the leaks suggest Siri will become more of a conductor, picking the right AI model for the task, across iPhone, iPad, Mac and a new wave of smart home devices.

Bob: The other thing being trailed is a new digital wallet trick. You'd be able to scan a physical card, ticket or loyalty pass with your camera, and Apple Wallet would import it as a usable digital version. Plus rumours of an upgraded Apple TV box with a much more powerful chip, aimed at gaming and on-device AI.

Samantha: For European users the Siri shift is the headline. Until now, a lot of the smarter Apple Intelligence features have rolled out late or in limited form in the EU because of Digital Markets Act questions. A more open Siri, one that can route to different AI providers, could actually fit the EU rulebook better than a closed-in system.

Bob: It also raises a competitive question. If Siri can route to OpenAI, to Anthropic, perhaps to European players, that's a much bigger shop window for Europe's own AI developers than the old setup, where you were either built into iOS or invisible.

Samantha: The catch is we'll know tomorrow how much of this is real and how much is wishful thinking. WWDC keynotes have a way of being both more and less than the leaks suggest.

Samantha: Quick interruption. If you listen to The State of Tech regularly, hit that like button and subscribe, that way you'll never miss an episode. Okay, moving on.

ChatGPT crosses one billion monthly active users, cementing AI assistants as everyday infrastructure.

Bob: OpenAI's ChatGPT has reportedly crossed one billion monthly active users. To put that in perspective, that's roughly one in every eight people on the planet opening the same AI assistant within a month.

Samantha: And it's not just casual use. The growth is being driven by people folding ChatGPT into daily work, drafting emails, summarising documents, writing code, planning trips. OpenAI also rolled out a new memory system recently that lets the assistant carry context across conversations more reliably, which tends to push usage up further.

Bob: A billion users also means a billion data points flowing through one company's servers. That's the part that should focus minds in Brussels. The EU AI Act treats general-purpose models like this one as systemic, with extra obligations on transparency, copyright and risk assessment.

Samantha: There's also the workplace angle. European employers are starting to formalise rules around what staff can and can't put into ChatGPT. The bigger the user base, the more confidential material ends up in prompts, and the more pressure on companies to offer secure enterprise versions, or block consumer access entirely.

Bob: For competitors this is sobering. Google, Anthropic, Mistral and others all have strong products, but ChatGPT is becoming a verb in the same way Google Search did. Once a tool gets that status, switching costs are mostly psychological.

Samantha: And for European users specifically, the milestone matters because it shapes whose assumptions get baked into the assistant most of us touch. Language, defaults, safety filters, they're all easier to tune for the biggest markets first. Europe's regulators will keep pushing for that to include EU norms, not just American ones.

Chinese supply chains tighten their grip on the optical modules and chips keeping global AI running.

Bob: Our fourth story is about the physical plumbing behind all this AI. Chinese firms now control more than sixty percent of the global market for optical modules, the high-speed components that shuttle data between servers inside AI data centres. And in the first four months of 2026, China's integrated circuit exports jumped eighty-three point seven percent in value.

Samantha: Optical modules are one of those bits of kit nobody outside the industry talks about, but without them you simply can't build a modern AI cluster. They're the difference between a data centre that can train a frontier model and one that chokes on its own traffic.

Bob: And the export surge in chips is striking because it runs against the political narrative. Despite US export controls, Chinese suppliers are shipping more, not less, particularly to other parts of Asia and into Europe. A lot of that is mid-range silicon, the kind that fills out servers around the headline GPUs.

Samantha: For Europe this is the uncomfortable middle. The EU wants strategic autonomy in chips, with the European Chips Act trying to lift local production. But the AI build-out happening right now, the data centres in Frankfurt, Dublin, the Nordics, depends on a global supply chain in which Chinese components are increasingly central.

Bob: That creates a policy tension. Brussels is aligned with Washington on parts of the export-control regime, yet European operators need these modules and chips to hit their AI capacity targets. The risk is hidden dependency, components quietly designed in or sourced from China, sitting deep inside European AI infrastructure.

Samantha: The bottom line: as global demand for AI compute keeps climbing, the question is no longer just who builds the chips, it's who builds everything around the chips. And right now, on a lot of that, China is ahead.

The first AI-designed cancer vaccine enters human trials, a milestone for biotech and medicine.

Bob: Now to a story we want to flag from the BBC. The first cancer vaccine designed using artificial intelligence has entered human clinical trials. Researchers used AI to scan tumour data and identify the specific protein targets a vaccine should train the immune system to attack.

Samantha: What's significant is the speed. Traditionally, picking those targets takes months of lab work and a lot of trial and error. The AI compressed that into a fraction of the time, and crucially, it personalises the vaccine to the individual patient's tumour, rather than offering a one-size-fits-all jab.

Bob: The trial is small and early-stage, so we're nowhere near a rollout. But the principle being tested matters: can an AI-designed therapy clear safety checks and show a real immune response in humans? If it does, the same approach could be aimed at other cancers, and eventually other diseases.

Samantha: For Europe there's both opportunity and pressure. The continent has serious cancer research centres, in Germany, the Netherlands, France, the UK, and a regulator, the European Medicines Agency, that has been working on guidance for AI in medical products. A successful trial pushes that guidance from theoretical to urgent.

Bob: There's also the access question. Personalised vaccines are expensive to make. If they work, European health systems will face hard choices about how to fund them and which patients qualify. That's a debate that tends to lag the science by years, and it probably can't this time.

Samantha: It's a reminder that the AI story isn't only chatbots and data centres. Some of the most consequential uses are quietly happening in hospital labs, and this trial is one of the first to put that promise in front of real patients.

Autonomous AI labs from Ginkgo Bioworks let researchers outsource tens of thousands of experiments to robots.

Bob: To close out, two things you can actually use today, or at least look up today. The first is from Ginkgo Bioworks, one of the companies running what are being called autonomous laboratories. These are facilities where AI-driven robots carry out experiments around the clock, doing tens of thousands of runs at a fraction of the cost of human researchers.

Samantha: For most listeners you won't be booking robot time yourself, but if you work in or near research, biotech, food science, materials, Ginkgo Bioworks lets external teams design an experiment online and have it executed in their automated lab. The human scientist sets the question and the constraints, the robots handle the pipettes.

Bob: It's worth a look today even just as a tour. Their site walks through how the workflow is structured, and what kinds of experiments are now realistic to outsource. For a European research lead juggling tight budgets and slow hiring, that's genuinely useful context.

Samantha: It also gives you a feel for where science is heading. The bottleneck is shifting from physically doing the work to designing the right questions and interpreting the data. That changes what skills early-career researchers need.

Bob: Available now from anywhere with a browser, in English, and you don't need to commit to anything to explore the platform.

Apple Wallet's new scan-to-add feature turns physical cards into digital ones with your camera.

Samantha: And the second one is more for everyday life. Among the WWDC leaks is a new Apple Wallet feature that lets you scan a physical card, a loyalty card, a membership pass, a ticket, and have Apple Wallet turn it into a usable digital version on your iPhone.

Bob: The idea is simple. Today you've probably got a stack of plastic cards from the supermarket, gym, library, coffee shop. The scan-to-add feature uses your camera to capture the relevant details and the barcode, then files it inside Apple Wallet so you can just tap your phone at the till instead.

Samantha: If the leaks are right, it should be live for many users within days of Apple's keynote tomorrow, rolling out through a software update on iPhone. For European listeners it'll work with most local loyalty schemes because it's reading the barcode rather than connecting to a back-end system.

Bob: It's not glamorous, but it's the kind of small change that genuinely lightens your wallet. Worth checking Apple Wallet on your iPhone after the update lands tomorrow and trying it with one card you actually use.

Samantha: And if you're on Android, similar features already exist in Google Wallet and apps like Stocard, so the broader trick of scanning cards into your phone is available today across platforms.

Samantha: Today we covered: an AI agent uncovering twenty-one zero-day flaws in FFmpeg, Apple's expected Siri overhaul at WWDC, ChatGPT crossing a billion monthly users, China's tightening grip on AI supply chains, the first AI-designed cancer vaccine entering human trials, and two things to try yourself: the autonomous lab platform from Ginkgo Bioworks, and the new scan-to-add feature in Apple Wallet.

Bob: Want to know more or react? Visit stateoftech.eu or email us at info@doorzetters.net.

Bob: State of Tech, the tech world in 15 minutes.