That's fair; the article is probably taking its information from the CVE and the links to Symantec's "Security Focus" where apparently the research claims to have prepared an exploit. The bug itself (which perhaps is all the VLC people are looking at, aside from the news, now?) is pretty bare bones.

I too have no idea where Gizmodo is getting the notion that it is being worked on. Perhaps they're getting that from the failed reproduction attempts.