STAR Fuzzer AI Agents Write Harnesses, Finding Critical Bugs in 45% of Projects Without Running Apps

Bright Security introduced STAR Fuzzer in October 2026, an agentic tool designed to detect memory-safety bugs and crashes in security-critical code without requiring a running application.

Root cause

The tool addresses a gap in traditional testing methods. Coverage-guided fuzzers like AFL++ and libFuzzer depend on human specialists to write and maintain harnesses for every target, a cost that limits their use. Dynamic application security testing (DAST) focuses on HTTP endpoints, rarely exercising the parsing code behind input validation. LLM-based pentesting tends to look only where models expect bugs to exist, leaving many memory-safety defects untested.

Attack path

STAR Fuzzer applies AI agents to automate the parts of fuzzing that typically require specialist judgment, such as choosing what to test and writing the harness. It uses an evolutionary search engine, first released in 2018, for the actual fuzzing process. This allows the tool to search for faults rapidly and deliver confirmed findings with byte-exact payloads that reproduce the issue.

Affected versions

The source material does not list specific software versions affected by the findings. It notes that in its first month of availability, the tool produced ten published findings in eight projects. These projects include the Crystal standard library, htop and RIOT OS. The initial research run found High or Critical issues in 45% of the projects tested.

Mitigation

The source material does not confirm that patches or fixes have been released for the specific findings mentioned. It states only that the findings were published. No general mitigation steps are provided in the text for the identified vulnerabilities.

Why it matters

Memory-safety defects often stem from how code handles unexpected or malformed input. Traditional testing methods frequently miss these issues because they require manual setup or focus on higher-level application interfaces. Agentic fuzzing automates the creation of test scenarios, allowing teams to examine low-level code paths more thoroughly. This approach helps identify crashes and memory exhaustion before attackers can exploit them. Teams should consider how automated harness generation might improve their testing coverage for critical libraries and system utilities that lack existing test suites.

What to do and how to stay safe: Bright Security

• Review published findings for projects your organisation uses, such as htop or the Crystal standard library.
• Monitor vendor channels for patches related to the ten published findings in the first month.
• Evaluate whether your current testing covers low-level parsing code behind input validation.
• Check if your security tools can generate test harnesses automatically for critical functions.

Step-by-step guide: Stop Sensitive Data Leaks in AI Chatbots: Priority Controls

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the difference between STAR Fuzzer and traditional fuzzers?

STAR Fuzzer uses AI agents to automatically write fuzzing harnesses and choose targets, whereas traditional fuzzers require humans to write harnesses for each target.

How many projects were affected in the initial research?

The tool found High or Critical issues in 45% of the projects tested in its first open source research run.

Can STAR Fuzzer test a running application?

No, the source material states that STAR Fuzzer finds bugs in security-critical code without a running application.