GitHub’s AI agent found 24 Android app vulnerabilities

* Kevin Stubbings built custom AI-driven audit workflows called taskflows using the Taskflow Agent.
* The research found more than 20 vulnerabilities in Android apps.
* In OsmAnd, an exported activity accepted intent extras that should have been restricted to an internal channel.
* This allowed applications to silently import malicious settings, such as swapping map tile sources to attacker-controlled servers.
* In the Wikipedia Android app, a hostname check used endsWith() instead of matching the full domain.
* This flaw allowed a deeplink link to point at a lookalike domain and load content within the app's WebView running attacker JavaScript in a trusted context.
* A second flaw in the cookie manager allowed the WebView to extract long-lived session cookies.
* The taskflows were specifically built for mobile apps to separate mobile entry points from web/desktop ones, focusing on intent-based bugs like confused deputy issues and insecure broadcasts.
* The AI model often flagged low-severity issues even when instructed not to and incorrectly judged the real-world impact when mitigating factors were present.

The experience highlights a critical tension between automated detection and contextual understanding in security analysis. The AI's ability to surface many potential flaws contrasts with its struggle in assessing real-world exploit viability, particularly where complex operational contexts—like how internal storage overrides external storage—intervene in the attack chain. This suggests that automated tooling excels at pattern matching known vulnerabilities but struggles with modeling adaptive adversary behavior and system-level countermeasures. The need for human oversight becomes paramount when mitigating factors inadvertently neutralize potential exploits flagged by the machine, underscoring that security is not just about identifying flaws but understanding the dynamic environment in which those flaws exist. If AI tools are primarily used to triage, they risk cementing a flawed perception of risk if the context of defense is ignored; conversely, relying solely on human expertise risks missing novel attack vectors that automated systems might yet to recognize. The structure implies that the value shifts from raw vulnerability counting to integrating deep system knowledge into the audit process.
Bridge Questions: How can auditing frameworks be engineered to better incorporate dynamic contextual state (like storage permissions or runtime environments) when assessing intent-based bugs? What mechanisms are required to reliably integrate human-level understanding of operational security into autonomous discovery systems, rather than just artifact detection? If AI cannot correctly judge mitigating factors, what is the optimal point for injecting domain-specific knowledge into agentic workflows to ensure actionable and accurate results?