GitHub Security Lab finds 24 Android vulnerabilities using open source AI agent

GitHub Security Lab has demonstrated the effectiveness of its open source Taskflow Agent by discovering 24 vulnerabilities in Android applications. The researchers developed specialized auditing taskflows to guide LLMs through mobile-specific attack surfaces, such as intent-based entry points. These automated workflows help security researchers find complex vulnerabilities that standard models might miss.

Mobile-specific AI auditing workflows

• The Taskflow Agent uses custom prompts to split research into incremental steps for better LLM accuracy.
• A new taskflow, gather_mobile_entry_point_info.yaml, distinguishes between mobile and non-mobile entry points to define the attack surface.
• The classify_application_local.yaml taskflow was modified to check for specific mobile vulnerability classes, such as confused deputy or insecure broadcasts, when intent-based entry points are identified.
• Running the audits requires a GitHub Copilot license and can consume significant token amounts due to frequent tool calls.

Why it matters

The release of these open source taskflows allows security researchers to automate complex mobile auditing processes using LLMs.