Intel / blog

How we found 24 Android vulnerabilities using our open source AI security agent

Source: github.blog
Author: Kevin Stubbings
Date: Published Sep 28, 2026

From the Daily Brief

GitHub Security Lab's Kevin Stubbings describes auditing Android apps with the open-source Taskflow Agent, driving the model through packaged taskflow prompts instead of a single request. The work produced 24 vulnerabilities by the post's title, with more than 20 reported.

The method is the useful part. Breaking an audit into incremental steps lets the model build up context and reach complex bugs it would miss in one pass. The taskflows are published with instructions for running them against your own repository.

The cost caveat is explicit: the flows consume many premium requests. That makes them a fit for targeted audits of high-value code rather than a continuous scan across every repository. Security teams already using Copilot can trial them on one Android project and compare the findings with their existing static analysis before deciding where they belong.

Read the 2026-09-29 Brief →

Context

GitHub reports finding and reporting 24 Android vulnerabilities with AI workflows that direct the search toward mobile-specific attack surfaces. Its Security Lab account describes first identifying where outside data enters an app, then checking those entry points against relevant vulnerability classes. This gives the model a concrete security question to investigate.

The same account explains why a finding still needs validation. A model may assume that attacker-controlled data changes an application's behavior, while another data source actually overrides it. Testing a proof of concept and reviewing the application's real behavior determine whether that proposed path works and how serious it is.

Key takeaways · AI-distilled

The Android taskflows first split entry points into mobile and non-mobile, then walk the model through a fixed checklist of vulnerability classes per entry point, such as confused deputy or insecure broadcasts for intents, mixing strict and open-ended prompts across runs.
In OsmAnd (10M+ Android downloads), an exported MapActivity trusted intent extras meant for an AIDL service, letting any app with no permissions silently import settings, point map tiles at an attacker server, and leak visited tile coordinates and route endpoints.
In the Wikipedia Android app, an endsWith hostname check on wikipedia:// deeplinks, repeated in the cookie manager, let a domain like evil-wikipedia.org load in the WebView and receive long-lived Wikimedia session cookies, enabling account takeover.
The author says the over-reported low-severity and near-impossible bugs and misjudged severity when mitigating factors applied, so every finding needed review by a mobile security researcher. Asking it to build a proof of concept helped surface false positives.
The team found the model understood security-relevant API behavior well even without the language's source code, and proofs of concept it generated from a vulnerability report usually needed little modification.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
LLM — A large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.

Read the source github.blog