Bright Security Launches STAR Fuzzer for Automated Memory-Safety Bug Detection
The new agentic tool writes its own harnesses and uses evolutionary algorithms to find crashes in security-critical code without running the application.
Key points
- Bright Security launched STAR Fuzzer on October 19, 2026, as a self-contained mode of its STAR platform.
- The tool identified High or Critical issues in 45% of open-source projects during its initial research run.
- It produced ten published findings in eight projects, including htop and the Crystal standard library, in its first month.
Bright Security announced the official launch of STAR Fuzzer on October 19, 2026, introducing an agentic application fuzzer designed to automate security testing. According to CyberNewswire, the San Rafael-based company released the tool as a self-contained mode of its existing Bright STAR platform, making it immediately available to users.
The system automatically identifies security-critical functions within codebases and generates a fuzzing harness for each one. It then searches for faults using an evolutionary algorithm and delivers confirmed findings with byte-exact payloads that reproduce the specific issue. This approach aims to remove the manual effort traditionally required to set up fuzzing targets.
How Agentic Fuzzing Works
STAR Fuzzer applies AI agents to steps that typically require specialist human intervention, such as selecting what to test and writing the harness code. According to GBHackers, the tool uses AI for these judgment-based tasks while relying on an evolutionary search engine for the actual fuzzing process. This combination keeps the search fast, repeatable, and evidence-based.
Traditional coverage-guided fuzzers like AFL++ and libFuzzer depend on people to write and maintain harnesses for every target. They also require manual triage of crashes, a cost that has historically limited fuzzing to specialist teams. Dynamic application security testing (DAST) tests running applications over HTTP but rarely exercises parsing code behind input validation.
Early Results and Scope
In its first open-source research run, STAR Fuzzer found High or Critical issues in 45% of the projects tested, according to Cyber Security News. During its first month of availability, the tool produced ten published findings across eight projects. These included vulnerabilities in the Crystal standard library, htop, and RIOT OS.
The tool detects crashes, memory exhaustion, and memory-safety bugs in security-critical code without requiring a running application. This allows it to target a class of outage-level defects often triggered by tiny malformed inputs that most application security programs do not test for. LLM-based pentesting tends to look where models expect bugs, leaving these areas exposed.
What should you do?
Security teams should evaluate whether their current testing strategies cover low-level memory safety. Since the tool is available now at brightsec.com/fuzzer, organizations can review the published findings to understand potential risks in their own software supply chains. Monitoring for new disclosures from this automated process is also advisable.
What to do and how to stay safe: Bright Security
- Review the ten published findings from the first month to check if your organization uses the affected projects like htop or RIOT OS.
- Assess whether your current dynamic testing tools exercise parsing and processing code behind input validation, as DAST often misses these areas.
- Monitor the Bright Security platform for new automated findings in open-source components you depend on.
- Ensure your application security program includes testing for memory-safety bugs and crashes, which are often triggered by small malformed inputs.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is STAR Fuzzer?
STAR Fuzzer is an agentic application fuzzer by Bright Security that automatically identifies security-critical functions, generates harnesses, and finds faults using an evolutionary algorithm.
How does it differ from traditional fuzzers?
Unlike traditional fuzzers that require hand-written harnesses and manual triage, STAR Fuzzer uses AI to automate harness creation and target selection while using an evolutionary engine for searching.
What results has it achieved so far?
In its first month, it produced ten published findings in eight projects, including htop and the Crystal standard library, and found High or Critical issues in 45% of tested open-source projects.
