In a September 28 report, GitHub Security Lab researcher Kevin Stubbings says he used repeatable sequences of AI prompts and code tools to audit Android apps and report 24 vulnerabilities.
The taskflows are repeatable sequences of model prompts and code-analysis steps. For Android, Stubbings first added a step to locate places where outside data enters an app, then asked the model to check bug types common to mobile software. He combined repeated, narrow prompts for known issues with broader prompts that could surface less obvious connections. A researcher designed the flows to direct an AI-assisted audit.
Two disclosed examples show what that focus can surface. In OsmAnd, an Android navigation app, an exposed settings-import feature could let another app silently change configuration and expose location and route data. In the Wikipedia Android app, a deep-link flaw could open a non-Wikipedia page in its in-app browser. GitHub says the page-handling and cookie issues could expose long-lived login tokens and enable account takeover across Wikimedia projects.
Stubbings says the model sometimes raised false positives and misjudged severity, so each report needs review by a mobile-security researcher. GitHub reports 24 findings but gives no number of apps audited or measured precision rate; the tally does not show how often an AI-assisted audit will find a valid issue.
Running the public taskflows requires a GitHub Copilot license and premium model requests. GitHub estimates an audit of a medium-sized repository may take one to two hours. Independent runs that report how many apps were examined and which findings survive expert confirmation would show whether the approach generalizes.
Sources
- GitHub Security Lab’s report, September 28, 2026
- Taskflow Agent framework
- Android taskflow definitions
- Illustration: Android robot by Google, licensed under CC BY 3.0; used unmodified as an Android illustration, with no endorsement implied.
