New STAR Fuzzer Automates Vulnerability Detection
The tool finds 10 bugs in one month by automating harness creation for 10 languages without manual intervention.
Updated on Oct. 26, 2026 in Software
Live Poll
Do you trust AI-driven tools to identify software vulnerabilities as effectively as human security experts?
Bright Security has launched STAR Fuzzer, an automated testing tool that identifies security-critical functions and generates test harnesses without requiring access to running applications. The engine, which utilizes an evolutionary algorithm, successfully identified 10 bugs in 8 open-source projects during its first month of public availability.
Why it matters
Traditional security fuzzing is often limited by the manual effort required to create harnesses and triage results, leaving many codebases under-tested. STAR Fuzzer attempts to remove these barriers by automating target selection and harness generation, shifting the burden from specialized human teams to AI agents.
STAR Fuzzer delivers a 51-times speed increase in persistent mode compared to standard execution. The tool supports 10 programming languages, including C, Rust, Go, and Python, and uses AI agents to triage crash results through IPC communication.
The players
Bright Security
A California-based cybersecurity company focused on automated application security testing tools.
The technology giant behind the OSS-Fuzz program, an initiative to continuously fuzz open-source software.
The details
The tool operates by using AI agents to automatically navigate a codebase, identifying functions that are likely to hold vulnerabilities. It then constructs a fuzzing harness—code that provides input to the target function—and uses an evolutionary algorithm to iterate through millions of inputs to identify crashes. By observing code behavior over inter-process communication (IPC) without requiring a live cloud scanner or authentication, the engine can find novel faults that standard pattern-matching tools miss.
Timeline
2018: Bright Security released the original evolutionary engine.
October 26, 2026: Bright Security officially launched STAR Fuzzer.
The Tech Race
While Google's OSS-Fuzz program has long standardized automated bug hunting for open-source code, many projects remain vulnerable to novel faults. Bright Security's new tool aims to accelerate this identification process by automating the labor-intensive harness-creation phase.
Developers and security teams can now deploy the tool to scan their own codebases without the need for specialized manual triage. The fuzzer is available immediately for projects across 10 supported languages.
The takeaway
The move from manual harness creation to automated AI agent orchestration signals a shift toward more continuous, low-friction security testing for open-source projects. Teams should monitor whether these findings lead to rapid patch deployments across the 8 affected projects.
Further reading
For broader trends in automated code analysis and vulnerability detection, see the latest developments in Software.
More information
To learn more about the tool or access the public demonstration, visit the STAR Fuzzer product page and demo.
Source note: This article includes information reported by CSO Online.
Live Poll
Do you trust AI-driven tools to identify software vulnerabilities as effectively as human security experts?
