Bright Security Launches STAR Fuzzer for Agentic Application Security Testing
Bright Security introduces STAR Fuzzer, an AI-powered tool that automates the generation of fuzzing harnesses and the identification of security-critical functions without requiring a running application.
Bright Security has officially launched STAR Fuzzer, an innovative agentic application fuzzer designed to revolutionize how security-critical code is tested. Built upon an evolutionary engine first released in 2018, STAR Fuzzer autonomously identifies security-critical functions, automatically generates tailored fuzzing harnesses for each, and employs an evolutionary algorithm to search for faults. A key differentiator is its ability to deliver every confirmed finding with a byte-exact payload for straightforward reproduction, all without needing a running application.
This new tool operates as a self-contained mode within the broader Bright STAR platform. Its agentic approach leverages artificial intelligence to automate complex aspects of fuzzing that traditionally demanded specialized expertise. This includes selecting targets for testing, writing the necessary harnesses, and triaging the resulting crashes to determine their significance. By automating these judgment-intensive steps, STAR Fuzzer aims to maintain speed, repeatability, and an evidence-based approach to vulnerability discovery.
The need for such an advancement stems from the limitations of existing fuzzing methodologies. While coverage-guided fuzzers like AFL++ and libFuzzer are powerful, they necessitate manual effort in writing and maintaining harnesses for each target and subsequently triaging the numerous crashes they produce. This overhead has historically confined their use to specialist teams and a limited set of critical projects. Dynamic Application Security Testing (DAST), on the other hand, tests applications over HTTP and often fails to exercise the deep parsing and input validation code where many subtle bugs reside.
STAR Fuzzer distinguishes itself by testing security-critical functions on untrusted input paths, automatically chosen by its AI agents. Unlike traditional fuzzers requiring manual harness creation, STAR Fuzzer generates and verifies these harnesses per function. Its search mechanism employs a structure-aware evolutionary algorithm guided by coverage and multiple fitness signals, a departure from the simple coverage-guided mutation of older tools. Furthermore, it automates the triage process for reachability and impact, providing a verified, byte-exact payload for each vulnerability, often delivered directly in a pull request.
Bright Security CTO Bar Hofesh highlights why LLMs alone cannot replace fuzzing for zero-day discovery. He points to the sheer scale of fuzzing campaigns, which can involve millions of concrete inputs, far exceeding the practical scope of LLM-driven analysis. Fuzzers operate at speeds of thousands of inputs per second, generating real-world behavior data, including sanitizer reports, which LLMs cannot replicate. LLMs also struggle with the nuances of compiled code, such as struct layouts and allocator behavior, which are invisible in source code alone.
Coverage is another critical factor where fuzzing excels. STAR Fuzzer's harnesses can reach thousands of code regions in a single run, with coverage feedback guiding the search. Code review, by contrast, lacks this signal for assessing the depth of testing. Moreover, LLMs and static analyzers tend to look for known patterns, missing the novel, unexpected bugs that often persist in mature code. Fuzzers, unburdened by expectations, are better positioned to find these 'unknown unknowns.'
In its initial open-source research run, STAR Fuzzer demonstrated its efficacy by identifying high or critical issues in 45% of the projects tested. During its first month of availability, it contributed to ten published findings across eight projects, including notable targets like the Crystal standard library, htop, and RIOT OS. These results underscore the tool's capability to uncover significant vulnerabilities that might otherwise be missed by conventional security testing methods.
The implications of STAR Fuzzer extend to developers and security teams seeking to improve the resilience of their applications. By automating the most labor-intensive aspects of fuzzing and providing reproducible findings, Bright Security aims to make advanced security testing more accessible and efficient, ultimately contributing to a more secure software ecosystem.