GitHub Finds 24 Android Bugs With Open-Source AI Agent

Overview

GitHub Security Lab has disclosed the discovery of 24 distinct vulnerabilities in Android applications through the use of an open-source artificial intelligence agent. The findings highlight a growing trend in cybersecurity, where AI-driven automation is becoming instrumental in identifying complex security flaws that traditional manual reviews might overlook.

The vulnerabilities were uncovered using the GitHub Security Lab Taskflow Agent, a tool designed to help security researchers automate, package, and share effective AI prompts and workflows. This initiative underscores the increasing role of large language models (LLMs) in enhancing software supply chain security and mobile application hardening.

Key Discoveries and Methodology

The primary vehicle for these discoveries is the Taskflow Agent, which allows researchers to guide AI models through incremental, structured steps rather than relying on broad, non-deterministic queries. This targeted approach enables the LLM to detect intricate vulnerability patterns within Android codebases more effectively than generic auditing tools.

While new AI models demonstrate improved code comprehension, custom taskflow prompts remain critical for guiding security researchers. By breaking down complex research into manageable phases, the agent can identify subtle flaws that might otherwise be missed in a single-pass analysis.

To facilitate this process, GitHub provided specific audit taskflows tailored for mobile applications. These workflows address the unique entry points and component interactions inherent to Android architecture, ensuring that the AI focuses on the most relevant attack surfaces.

The combination of strict prompts and repeated runs ensures obvious vulnerabilities aren’t missed, while broad prompts let the AI apply its creativity to the fullest.

Researchers noted that using these specialized taskflows allowed them to report more than 20 vulnerabilities in Android applications. The results are publicly available on the GitHub advisories page, providing transparency and actionable data for developers seeking to secure their mobile offerings.

How the Taskflows Operate

The effectiveness of the agent lies in its ability to distinguish between different types of application components within a repository. Many modern projects contain hybrid codebases, including mobile apps, web servers, and desktop applications. The taskflow first identifies mobile entry points—locations where attacker-controlled data can flow into the application—and separates them from non-mobile components.

This separation is crucial because it allows the AI to run audits on the correct attack surface without being distracted by irrelevant code. The system then applies a curated list of known vulnerability classes relevant to mobile contexts, such as confused deputy issues or insecure broadcasts.

For instance, if the agent identifies an intent-based entry point, it is programmed to specifically check for common intent-related flaws. This contextual awareness helps maintain a coherent threat model and improves the accuracy of the findings.

Implementation Requirements

Organizations interested in replicating these results can access the open-source taskflows via the seclab-taskflows repository. However, there are specific prerequisites and costs associated with running these audits:

• A GitHub Copilot license is required to execute the agent.
• The prompts utilize premium model requests, which can consume significant tokens.
• Running audits on medium-sized repositories may take one to two hours and involve numerous tool calls.

Users are advised to monitor token usage carefully, as the comprehensive nature of the audit can lead to high API costs.

Case Study: Tracking Users via OsmAnd

Among the 24 reported vulnerabilities, one significant finding involves OsmAnd, a widely used navigation application with over 10 million downloads on the Android platform. The flaw allows malicious apps to track a user’s location by exploiting an exported activity within the app.

In Android, an activity represents a single screen with which a user can interact. When an activity is marked as exported, it can be launched by components outside of its own application. OsmAnd’s MapActivity is exported and handles opening settings files and deep links.

The Vulnerability Mechanism

The core issue stems from how intent extras—key-value pairs of data attached to intents—are handled. MapActivity expects specific extras such as settings_version, silent_import, and replace to be passed through an internal AIDL service. However, Android provides no mechanism to restrict which extras an external caller can set on an intent to an exported activity.

Consequently, any malicious app can send an intent to MapActivity with arbitrary extras. This allows an attacker to:

• Import settings silently without triggering a user notification.
• Replace existing settings rather than adding to them.
• Bypass user confirmation dialogs during import.

The vulnerability exists because the app relies on the source of the intent extras rather than validating them properly. Since any app can forge these extras, the security boundary provided by the internal service channel is effectively bypassed.

This finding illustrates the importance of validating input from all external sources, regardless of whether the data appears to originate from a legitimate internal process. The disclosure of this bug serves as a critical reminder for mobile developers to rigorously audit exported components and intent handling logic.