Bright Security Launches STAR Fuzzer to Automate Vulnerability Discovery

Bright Security has announced the official launch of STAR Fuzzer, an “agentic” application security tool designed to automate the identification and exploitation of vulnerabilities in security-critical code. The platform aims to solve a long-standing bottleneck in software testing by using AI agents to handle the complex setup and triage processes that typically require human specialists.

Traditional fuzzing, a technique that involves sending massive amounts of random or structured data to a program to trigger crashes, is highly effective at finding memory-safety bugs and logic flaws. However, tools like AFL++ and OSS-Fuzz require engineers to manually write “harnesses”—small pieces of code that connect the fuzzer to the specific functions being tested. STAR Fuzzer automates this step, identifying critical functions and generating the necessary harnesses without human intervention.

Automation of Harness Generation and Triage

The system operates by applying AI agents to the judgment-heavy stages of the testing lifecycle: choosing targets, writing code harnesses, and triaging results. While the agents handle the setup, the actual discovery is performed by an evolutionary search engine first developed by the company in 2018. This engine runs millions of inputs against compiled code, observing real-time behaviour rather than merely predicting outcomes.

According to Bar Hofesh, Co-founder and CTO of Bright Security, the search process was never the primary obstacle to widespread fuzzing adoption. “The harnesses and the triage were. STAR Fuzzer automates both, so the evolutionary engine we built in 2018 can finally run across a whole codebase,” Hofesh stated.

Finding Zero-Days in Open-Source Projects

Before its public release, the tool was tested against several mature open-source projects. Bright Security reported that 45% of the projects tested contained high or critical severity vulnerabilities. In its first month, the platform produced ten published findings across eight projects, including the htop process viewer, the RIOT OS embedded operating system, and the Crystal standard library.

Specific vulnerabilities identified include:

• htop: An out-of-bounds read (CWE-125) in the /proc/PID/stat parser caused by a missing bounds check.
• RIOT OS: An off-by-one error (CWE-193) where a NUL byte was written outside of a buffer.
• Crystal Standard Library: Type confusion in XML processing and a stack overflow in YAML hashing.
• TwelveMonkeys: An uncapped array allocation (CWE-789) that allowed a 38-byte file to force a multi-gigabyte memory allocation.

Many of these bugs existed in code that had already been audited by static analysis tools or large language models (LLMs). The company noted that while LLMs are effective at identifying known patterns, they often struggle to predict the behaviour of compiled code or reach deep logic paths without the feedback loop provided by a fuzzer.

The Role of Agentic Fuzzing in AI-Driven Development

As organisations increasingly use AI to generate code, the need for automated security validation has grown. STAR Fuzzer is designed to run within a customer’s environment without requiring a live application or cloud scanner. It supports a wide range of languages, including C/C++, Rust, Go, Java, Kotlin, .NET, Node.js, Python, and Crystal.

A key feature of the tool is its ability to provide “byte-exact” payloads. When a crash is detected, the system delivers a pull request to developers containing the exact file and input needed to reproduce the fault. This removes the ambiguity often associated with automated security alerts, where developers must spend hours determining if a finding is a false positive.

The platform is now available as a specific mode of the Bright STAR platform. It is particularly targeted at teams managing software that processes untrusted inputs below the HTTP layer, such as file parsers, image processors, and industrial binary protocols.