GitHub Security Lab’s AI agent surfaces 24 Android vulnerabilities

Open source taskflows built on GitHub’s AI agent have already exposed dozens of Android flaws in real apps.

GitHub’s Security Lab built the GitHub Security Lab Taskflow Agent to let security researchers package and automate AI-driven code-auditing workflows, and then created Android-focused taskflows on top of it. These Android taskflows, which are open source but require a GitHub Copilot license and use premium model calls, have so far helped the team report over 20 vulnerabilities in Android apps and 24 issues overall. The author added a gather_mobile_entry_point_info.yaml taskflow that identifies mobile-specific entry points so the AI can focus on the correct attack surface in mixed-code repositories. They also modified classify_application_local.yaml to ensure the LLM consistently checks for a curated list of common Android vulnerability classes, including intent-related issues like confused deputy and insecure broadcasts. One example described is an OsmAnd Android bug in which an exported MapActivity trusted intent extras that should only have come from an internal AIDL service, allowing a malicious app to silently import settings and track the user’s location.