GitHub Security Lab said on September 28 that it had found and reported 24 vulnerabilities in Android applications using targeted workflows for its open-source Taskflow Agent. The findings concern mobile apps, not 24 flaws in the Android operating system itself.

The approach adds Android-specific guidance to AI-assisted code auditing. One taskflow separates mobile entry points from other application components; another directs the model to check relevant vulnerability classes. Repeated runs combine focused checks with broader analysis to identify connections between components.

The underlying agent framework, documented in GitHub's public repository, expresses workflows in YAML and lets agents use tools through the Model Context Protocol. The mobile research applies that framework to attack surfaces such as exported activities, intents and embedded web views.

GitHub highlighted two disclosed examples. In the OsmAnd navigation app, a settings-import flaw allowed another installed app to change configuration without user confirmation, potentially exposing location and route information. In Wikipedia's Android app, related hostname-validation mistakes could combine to expose authentication cookies and enable account takeover after a user followed a malicious deep link.

The results still required security expertise. GitHub says the models sometimes overstated severity, overlooked mitigating factors or produced findings dependent on unrealistic conditions. It recommends review by researchers familiar with mobile applications rather than treating generated reports as confirmed vulnerabilities.

For developers trying the published mobile workflow, GitHub says a Copilot license is required and premium model requests can consume substantial tokens. A medium-sized repository may take one or two hours to audit. The practical result is a reusable research workflow with documented findings—not evidence that autonomous auditing can replace human validation.