GitHub’s Android audit agent found 24 reported vulnerabilities

GitHub Security Lab reports 24 Android vulnerabilities found with targeted AI audit workflows. The agent identifies mobile entry points, then checks relevant vulnerability classes across repeated runs; researchers disclose concrete examples in OsmAnd and Wikipedia. The open-source workflow requires a Copilot license and consumes premium requests. Use it to generate findings for review, not as proof that an app is secure.

GitHub Security Lab · Sep 28, 2026

Why it matters

Targeted threat models turn an open-ended code audit into smaller, more inspectable tasks.

More context

Try the published taskflows on your own repository with a token budget. Results are stored in SQLite for inspection; the author estimates one or two hours for a medium repository.

Keep in mind

The reported vulnerability count is a case study, not a measured detection rate or a false-positive benchmark.

Original read