Boffins build automated Android bug hunting system

AI models get slammed for producing sloppy bug reports and burdening open source maintainers with hallucinated issues, but they also have the potential to transform application security through automation. Computer scientists affiliated with Nanjing University in China and The University of Sydney in Australia say that they've developed an AI vulnerability identification system that emulates the way human bug hunters ferret out flaws. Ziyue Wang (Nanjing) and Liyi Zhou (Sydney) have expanded upon prior work dubbed A1, an AI agent that can develop exploits for cryptocurrency smart contracts, with A2, an AI agent capable of vulnerability discovery and validation in Android apps. They describe A2 in a preprint paper titled "Agentic Discovery and Validation of Android App Vulnerabilities." The authors claim that the A2 system achieves 78.3 percent coverage on the Ghera benchmark, surpassing static analyzers like APKHunt (30.0 percent). And they say that, when they used A2 on 169 production APKs, they found "104 true-positive zero-day vulnerabilities," 57 of which were self-validated via automatically generated proof-of-concept (PoC) exploits. One of these included a medium-severity flaw in an Android app with over 10 million installs. "We discovered an intent redirect issue," said Liyi Zhou, a lecturer in computer science at The University of Sydney, in an email to The Register. "This is not a trivial bug, and it shows A2’s ability to uncover real, impactful flaws in the wild." A...