In late 2025 FFmpeg’s maintainers called a Google Big Sleep report about a codec used by a 1995 game “CVE slop” and questioned whether trillion-dollar companies should use AI to find bugs in volunteer-run code and expect volunteers to fix them; Google’s policy starts a 90-day clock whether or not a patch exists.

What this evidence bears on

• Supports: Volunteer projects like FFmpeg aren’t vendors stalling; they simply don’t have the people to fix a flood of reports in any deadline.

  • A reply in “Keep 90 days”

• Supports: Many AI reports are low-value, so a fixed clock forces volunteers to spend scarce time on bugs that barely matter.

  • A reason for “Give maintainers more time”

• Supports: Trillion-dollar companies rely on volunteer code like FFmpeg, so dumping bug reports on its volunteers shifts their costs onto unpaid people.

  • A reason for “Keep the deadline, make the finders fix it”