GitHub opens an agent that writes fuzz harnesses and triages the crashes

GitHub published a fuzzing taskflow for its Security Lab Taskflow Agent on Thursday. According to the post, the pipeline finds entry points in C and C++ code, writes the fuzz harnesses, runs AFL++, reads the coverage report and triages the crashes, with no person in the loop while it works.

The code is public, at GitHubSecurityLab/seclab-taskflows-fuzzing. The post is by Antonio Morales of the Security Lab. He says the default model is Claude Sonnet 5, which he picked because it passed every one of the team's internal tests, and that a configuration file may point the taskflow at another model.

Morales says to run the taskflow only inside a disposable environment, such as a Codespace or a throwaway virtual machine, and without elevated privileges. The reason he gives is that the agent could run arbitrary build commands, and the binaries it produces, directly on the host.

Getting started takes a single command against a repository, which the post demonstrates on the cJSON library. The agent marks the patches it proposes review required, and Morales says a person has to verify them. The post reports no bug counts from live campaigns, so how well it works in the field is untested here.