GitHub Security Lab open-sources a Claude Sonnet 5 agent that runs whole AFL++ fuzzing campaigns

GitHub Blog·medium signalXBlueskyLinkedInCopy link

The Fuzzing Taskflow in GitHubSecurityLab/seclab-taskflows-fuzzing works on C/C++ projects. It picks entrypoints, reads the build system, writes harnesses, runs AFL++, iterates on coverage reports with plateau detection, triages every crash and writes a vulnerability report for each unique bug. It includes structure-aware mutators for JSON, XML, regex and PNG. Claude Sonnet 5 is the default model because it passed all of GitHub's internal tests. GitHub recommends running it in disposable Codespaces because the LLM chooses the build commands. The post gives no bug counts yet.