GitHub AI Taskflows Found 24 Android App Vulnerabilities

GitHub Security Lab has shown what careful AI-assisted bug hunting looks like in practice. Researcher Kevin Stubbings built open-source taskflows on the Taskflow Agent and used them to find and responsibly disclose 24 vulnerabilities in Android apps, according to a Help Net Security report on September 29, 2026.

• The taskflows led to 24 disclosed vulnerabilities across Android apps, though some outlets round this to "20+".
• One taskflow maps app entry points such as exported activities, services, broadcast receivers and deep links; a second assesses each against known vulnerability classes.
• The AI often flagged low-severity issues and misjudged mitigations, so a person reviewed every finding before disclosure.
• The taskflows are free and open source, but they require a GitHub Copilot license and use premium requests.

How do the GitHub AI taskflows work?

The approach splits a security review into two repeatable steps. The first taskflow enumerates how an Android app can be reached from outside: exported activities, services, broadcast receivers and deep links. The second takes each entry point and checks it against classes of problems such as insecure intents, confused deputy bugs, unsafe broadcasts, cross-app scripting and WebView risks.

Breaking the job into small, well-defined tasks is what makes it reliable. Instead of asking one model to "find bugs," the taskflows guide it through a structured checklist, the way a human reviewer would.

What kinds of issues did it find?

Help Net Security describes two examples of the type of finding. In one widely downloaded navigation app, an exported activity accepted intent extras that could let another app silently import settings. In a large encyclopedia app, a hostname check built on a string-suffix comparison could have allowed session-cookie theft. Both were disclosed to the developers as part of the project, which is exactly how this research is meant to work.

Why is human review still essential?

This is the most instructive part of the write-up. According to GitHub's findings as reported by Help Net, the AI kept flagging low-severity issues and sometimes misjudged existing mitigations. A human reviewed every result before anything was disclosed. The lesson for security teams is that AI can widen the net and save hours of triage, while experienced people decide what is real, how serious it is and what to report.

Can you try it yourself?

Yes. The taskflows are open source, which means developers can adapt them for their own apps. They do require a GitHub Copilot license and consume a meaningful number of premium requests, so teams should budget for that when scanning many apps.

This fits a growing pattern of defenders putting agents to work, like the AndroidX Security State library for tracking patches and broader moves to make Android passkey transfer safer. See more in our AI security coverage.

Sources: Help Net Security: GitHub AI taskflows find Android app vulnerabilities — September 29, 2026; GitHub Blog: How we found 24 Android vulnerabilities using our open-source AI security agent — September 2026; Tech Times: GitHub's AI security agent found 24 Android CVEs — September 30, 2026.