GitHub AI Agent Discovers 24 Vulnerabilities in Android Apps

• •GitHub's AI agent found over 20 vulnerabilities in Android apps.
• •Critical flaws were identified in OsmAnd and the Wikipedia app.
• •The vulnerabilities involve improper intent handling and hostname checks.

GitHub Security Lab's AI-driven Taskflow Agent identified over 20 vulnerabilities in Android applications, including critical issues in popular apps like OsmAnd and the Wikipedia app. The vulnerabilities stem from improper handling of intent extras and hostname checks, allowing potential exploitation by malicious actors. The AI model, while effective in finding vulnerabilities, struggled with accurately assessing their severity, necessitating human review before any findings are acted upon. The taskflows are open source and can be run against any repository, but require a GitHub Copilot license. The vulnerabilities were disclosed on September 28, 2026, and are significant due to their potential impact on millions of users. The vulnerabilities are not yet confirmed to be actively exploited in the wild.