GitHub Security Lab Releases Autonomous Fuzzing Taskflow for C/C++ Projects

GitHub Security Lab has released the Fuzzing Taskflow, an autonomous pipeline designed to automate the manual aspects of fuzzing C/C++ projects. Built on the GitHub Security Lab Taskflow Agent framework, the tool identifies entrypoints, writes harnesses, runs AFL++, analyzes coverage, and triages crashes without continuous human intervention.

Architecture and Execution

The system separates decision-making from execution: the LLM agent decides what to fuzz and how to improve coverage, while MCP tools handle the actual work of running AFL, compiling harnesses, and reading reports. State is managed via a SQLite database, ensuring stages communicate through persistent storage rather than memory.

Key design features include:

• Dual-binary builds: Each harness is compiled twice, once with AFL instrumentation for fuzzing and once with coverage instrumentation for generating human-readable reports.
• Model selection: The pipeline defaults to Claude Sonnet 5, chosen for passing internal security tests, though users can configure other models.
• Security warning: The agent runs build commands directly on the host; users are advised to run it only in disposable environments like Codespaces.

Coverage Feedback Loop

The core innovation is an iterative coverage-feedback loop that mimics a human researcher’s workflow. The agent analyzes uncovered branches and chooses actions such as adding seeds, editing harnesses, or enriching dictionaries. Time budgets for fuzzing double each iteration, starting at 30 seconds and scaling up to 960 seconds per target. The loop stops when two consecutive iterations yield less than 1% absolute line coverage gain.

Structure-Aware Fuzzing

To handle structured inputs like JSON, XML, and regex, the taskflow employs four mechanisms:

• Pre-built AFL dictionaries and custom mutators for known formats.
• Source-level dictionary generation that extracts string literals and constants from the target’s code.
• Dynamic dictionary enrichment that adds tokens found in guards near uncovered lines.
• A corpus-splice operator that recombines sub-regions of existing inputs.

Triage and Reporting

After fuzzing, the agent minimizes crashes with afl-tmin, replays them under ASan, and deduplicates them by stack trace. It then generates markdown reports with verdicts such as vulnerability, harness_bug, or duplicate. Each report includes root-cause analysis, reachability arguments, and suggested fixes, though these are marked as requiring human review.