GitHub Security Lab Hands AFL++ Coverage Chasing to an LLM Taskflow

GitHub Security Lab’s Antonio Morales published a September 24, 2026 GitHub Blog post describing the Fuzzing Taskflow—an autonomous pipeline for C/C++ projects built on the Lab’s Taskflow Agent framework and released in the public repository GitHubSecurityLab/seclab-taskflows-fuzzing under an MIT license. The pitch is blunt: continuous fuzzing still fails when nobody writes new harnesses for uncovered code or triages the crash pile, and the Lab wants an LLM agent to own those repetitive steps while MCP tools own execution. GitHub’s repository metadata lists the license as MIT, language Python, and updated_at on September 24, 2026 alongside the blog post.

Operators start a Codespace from the repository and run ./scripts/fuzzing/run_fuzzing.sh owner/repo—for example tukaani-project/xz for a real campaign or DaveGamble/cJSON for a smoke test. The agent installs AFL tooling, clones the target, identifies entry points, and writes fuzz targets without a human babysitting each stage. Morales is explicit about the threat model: the taskflow runs afl-fuzz, clang, and LLM-chosen build commands directly on the host with no container boundary, so a prompt-injected agent can do anything the user can. The recommended posture is a disposable Codespace or throwaway VM without elevated privileges. Default model configuration uses Claude Sonnet 5 after internal guardrail tests; other models are selectable in src/seclab_taskflows_fuzzing/configs/model_config.yaml.

Architecture separates judgment from execution. A shell driver chains stages; YAML taskflows encode the prompts; MCP tools expose primitives such as compile harness, run AFL for a budget, store a crash, and read coverage. State lives in SQLite (fuzz_context.db) so stages communicate through durable records rather than in-memory handoffs. Each harness builds twice: an .afl binary with AFL LTO instrumentation plus ASan/UBSan for mutation guidance, and a .cov binary with Clang source-based coverage so queue replay yields human-readable line and branch reports instead of AFL’s opaque edge map.

The coverage-feedback loop is the centerpiece. Time budgets double across iterations from 30 seconds to about 960 seconds per target. After each AFL window, the agent replays the queue against the coverage binary, reads uncovered branches, and chooses among adding a crafted seed, editing the harness to call another API, auto-enriching the AFL dictionary from nearby guards, or skipping cold error paths and vendor code. Plateau detection—two consecutive iterations gaining less than a configurable absolute line-coverage threshold (default 1%)—stops diminishing-return thrash. Structure-aware mutators ship for recognized formats (JSON, XML, regex, PNG, length-prefixed TLV), while unrecognized targets get source-scanned dictionaries of string literals and 32-bit constants, coverage-driven dictionary growth from strncmp/memcmp/case guards, and corpus-splice recombination. Per-harness corpus directories survive across iterations and campaigns and are kept bounded with afl-cmin.

Triage closes the loop. Crashes are minimized with afl-tmin, replayed under ASan, deduplicated by normalized stack-top hashes, checked against previously known crashes for upstream fixes, and turned into markdown reports with verdicts such as vulnerability, library_hardening, harness_bug, OOM, timeout, assertion_failure, or duplicate. Reports include file:line root-cause sketches, reachability arguments, exploitability notes, suggested unified diffs, and regression-test outlines—explicitly marked “review required” because the agent still misreads code. A live HTML dashboard on port 8765 shows per-harness pulses, coverage sparklines, crash heatmaps, and iteration timelines during a campaign.

That warning about host execution is not a footnote. Security researchers have spent 2026 watching coding agents inherit repository-supplied configuration and plugin code; an AFL campaign that also lets the model choose build commands is a high-privilege loop by design. GitHub Security Lab’s answer is environmental rather than rhetorical: run in Codespaces, prefer throwaway VMs, skip elevated privileges, and treat suggested patches as review-required drafts. The live dashboard on port 8765 then becomes an audit surface—coverage trends and crash heatmaps you can watch while the agent works—rather than a black-box overnight job.

For Writeble’s cyber-security desk, the Fuzzing Taskflow is the September 24 primary that pairs cleanly with agent-governance stories elsewhere in the package: it is MIT-licensed, dated, and concrete about both capability and risk. Maintainers of C/C++ libraries can point it at a repository and get harness drafts plus triage notes they never had bandwidth to write, provided they treat the agent’s patches as starting points and run the whole campaign inside disposable isolation. That combination—open automation with an honest host-execution warning—is rarer than another generic “AI finds bugs” claim.