Bright Security has officially released STAR Fuzzer, an agentic application security tool designed to identify critical vulnerabilities in code without requiring a running application, according to a recent report by CSO Online.
The tool utilizes artificial intelligence to automate the traditionally labor-intensive processes of selecting security-critical functions, generating test harnesses, and triaging potential crashes. By employing an evolutionary algorithm, STAR Fuzzer searches for memory-safety bugs, crashes, and memory exhaustion issues. Unlike traditional coverage-guided fuzzers that require manual harness maintenance, or dynamic application security testing that relies on HTTP-based interaction, this platform operates independently of a running application. It supports a wide range of programming languages, including C, C++, Rust, Go, Java, Kotlin, Crystal, and Node.
During its initial research phase, the tool identified high or critical security issues in 45% of tested projects. In its first month of availability, it produced 10 confirmed findings across eight projects, including the Crystal standard library and htop. The platform provides developers with byte-exact payloads to reproduce findings, facilitating faster remediation. This approach aims to address vulnerabilities that often evade large language model-based code reviews, which typically focus on known patterns rather than the unexpected behaviors identified through millions of real-world execution cycles.
Source: CSO Online
