How GitHub Security Lab used AI taskflows to audit Android apps: 24 vulnerabilities reported, including location tracking and a Wikipedia account takeover
A GitHub Security Lab researcher explains how the team wrote Android-focused audit taskflows for its open-source GitHub Security Lab Taskflow Agent and has so far found and reported 24 vulnerabilities, including critical issues that allowed tracking OsmAnd users’ locations and taking over Wikipedia Android app accounts. Anyone can run the taskflows, but they require a GitHub Copilot license and consume premium model requests.
Taskflow Agent is GitHub Security Lab’s tool for automating, packaging and sharing AI prompts and workflows. The author added two steps to colleagues’ existing audit taskflows: first separating code entry points into mobile and non-mobile ones so the model sees the right attack surface even in mixed repositories, then having the model check each entry point and component against a list of common Android vulnerability classes, such as intent-based confused-deputy bugs and insecure broadcasts. A strict prompt with repeated runs guards against missing obvious bugs, while a broad prompt gives the model room to be creative.
The taskflows are open source: start a Codespace from the seclab-taskflows repository and run one audit script. A medium-sized repository takes roughly an hour or two, and results land in an SQLite table that flags rows with suspected vulnerabilities. Running them requires a GitHub Copilot license, uses premium model requests, and the many tool calls can consume a large number of tokens.
Both examples in the post have already been disclosed. The Android version of the navigation app OsmAnd, with over 10 million downloads, exported a MapActivity that accepted intent extras meant only for an internal service, so any app—even one with no permissions—could silently import settings and swap the map-tile URL, sending the coordinates of every tile the user loaded, and the start and end of every route, to an attacker’s server. In the Wikipedia Android app, a hostname-parsing bug in wikipedia:// deeplinks let an attacker page ending in wikipedia.org load and run JavaScript; combined with a similar bug in the check for attaching cookies, it exposed long-lived and session tokens valid across every Wikimedia project, enabling account takeover.
The author is explicit about limits: the models are good at finding bugs but often flag issues that are nearly impossible to trigger in practice, report low-severity bugs even when told not to, and frequently misjudge severity, so every finding needs review by a researcher who knows mobile apps; seeing mitigating factors often requires asking the model to write a proof of concept, and false positives remain. On the other hand, the team was surprised by how well the model understood security-relevant API behavior, and most generated proofs of concept needed little modification. Most of the 24 bugs are simple ones such as path traversal, with a handful critical, clustered where researchers would expect—cross-app scripting in WebViews and exposed JavaScript bridges.