GitHub's Security Lab released the Taskflow Agent, an AI framework that automates fuzzing for C and C++ projects, according to a post by researcher Antonio Morales on the GitHub Blog.
The framework runs through three layers: a shell driver that chains pipeline stages together, Taskflow YAML files that guide an LLM agent through each step, and MCP tools that do the actual work of running AFL, compiling test harnesses and analyzing crashes, Morales wrote.
The agent identifies entry points in a codebase, analyzes its build system, writes harnesses, runs fuzzing campaigns, reads coverage reports and produces vulnerability assessments without a person managing each step, according to the post. Morales wrote that fuzzing "still needs a human in the loop," but the framework removes the repetitive work of writing new harnesses for uncovered code and triaging crashes.
The tool is open source and runs immediately in GitHub Codespaces, according to the post.
Fuzzing has always been limited by how much attention a human security researcher can spend chasing coverage gaps. An agent that keeps a fuzzing campaign fed with harnesses and triage on its own does not replace that researcher's judgment on what a crash means, but it changes how many codebases get fuzzed at all.