GitHub Security Lab detailed a new open-source fuzzing taskflow for C/C++ projects on September 24. Built on its Taskflow Agent framework, the pipeline takes a GitHub repository, identifies test targets, writes harnesses, runs AFL++ and prepares reports on crashes.

The substantive addition is a coverage-feedback loop. After each fuzzing round, the agent reads coverage reports and chooses whether to add inputs, change a harness to exercise another API, or expand a dictionary of values that help reach untested branches. It can also skip gaps judged unproductive.

The system builds each harness twice: one binary guides AFL++ fuzzing, while another replays generated inputs to measure source coverage. Fuzzing time budgets increase across iterations, and plateau detection ends the loop when coverage gains remain below a configurable threshold. A persistent input corpus carries discoveries between campaigns.

The architecture separates decisions from execution: the language model chooses the next action, MCP tools perform operations, and a SQLite database holds campaign state. After testing, the pipeline minimizes and deduplicates crashes, then produces analyses that distinguish potential vulnerabilities from harness bugs and other failures.

There are important limits. GitHub says the agent can make incorrect judgments, and suggested patches are marked for human review. The workflow also runs model-selected build commands directly on its host; the announcement recommends a disposable Codespace or virtual machine without elevated privileges.

For maintainers, the practical proposition is automating the recurring work around fuzzing—not replacing the fuzzer or treating generated vulnerability reports as confirmed findings. The repository describes the project as under active development.