Bright Security Introduces STAR Fuzzer, Agentic Fuzzing That Writes Its Own Harnesses and Proves Every Finding

San Rafael, United States, October 19th, 2026, CyberNewswire

Developed on an evolutionary engine very first launched in 2018, STAR Fuzzer by Bright Security discovers crashes, memory fatigue and memory-safety bugs in security-critical code without a running application. In its very first open source research study run, it discovered High or Critical concerns in 45% of the jobs evaluated, and in its very first month of accessibility it produced 10 released findings in 8 jobs, consisting of the Crystal basic library, htop and RIOT OS.

Bright Securitythe Agentic Offensive Application Security business, today revealed the main launch of STAR Fuzzer, an agentic application fuzzer that instantly determines security-critical functions, creates a fuzzing harness for each one, look for faults with an evolutionary algorithm, and provides every validated finding with a byte-exact payload that recreates it. STAR Fuzzer is a self-contained mode of the Bright STAR platform and is readily available now at brightsec.com/fuzzer

Agentic fuzzing uses AI representatives to the parts of fuzzing that have actually typically needed a professional: picking what to check, composing the harness, and choosing which crashes matter. STAR Fuzzer utilizes AI for those actions and an evolutionary online search engine for the fuzzing itself, so the parts that require judgment are automated and the search remains quickly, repeatable and proof based.

Why Fuzzing Needed a New Approach

Coverage-guided fuzzers such as AFL++ and libFuzzer are shown and extensively utilized, and programs like Google’s OSS-Fuzz have actually demonstrated how much they can discover. They depend on individuals to compose and keep a harness for every target and to triage the crashes that come back. That expense has actually kept fuzzing focused in professional groups and a subset of crucial jobs.

Other screening techniques do not fill the space. Dynamic application security screening (DAST) checks what an aggressor can reach over HTTP, so it seldom works out the parsing and processing code behind input recognition. LLM-based pentesting works at recognized vulnerability patterns however tends to look where a design anticipates bugs to be. The outcome is a class of outage-level and memory-safety problems, typically activated by small malformed inputs, that a lot of AppSec programs never ever test for.

How STAR Fuzzer compares to standard coverage-guided fuzzers (such as AFL++ and libFuzzer) and DAST:

• What it Tests: Standard fuzzers test works exposed through a hand-written harness. DAST trial run applications over HTTP. STAR Fuzzer tests security-critical functions on untrusted-input courses, picked immediately.
• Harness: Standard fuzzers require harnesses composed and kept by engineers. DAST does not utilize one. STAR Fuzzer produces a harness per function with AI, then validates it reaches its target.
• Browse: Conventional fuzzers utilize coverage-guided anomaly. DAST sends out request-level attack payloads. STAR Fuzzer utilizes a structure-aware evolutionary search directed by protection and numerous physical fitness signals.
• Running App Needed: Standard fuzzers, no. DAST, yes. STAR Fuzzer, no.
• Triage: Handbook for conventional fuzzers and developed into the scanner for DAST. STAR Fuzzer triages immediately for reachability and effect.
• Output: Standard fuzzers return crash inputs and logs. DAST returns a vulnerability report. STAR Fuzzer provides the file, function and byte-exact payload in a pull demand.
• Repair Validation: Conventional fuzzers require a manual re-run and DAST requires a rescan. With STAR Fuzzer, groups replay the payload.

Discovering the Bugs LLMs Miss

Ask an LLM to examine a parser and it will discover the bug classes it currently understands from training. The zero-days that make it through for several years in fully grown, commonly released code are the ones that match no recognized pattern. STAR Fuzzer utilizes AI to pick targets and develop harnesses, however the search that discovers the bugs is not an LLM. It does not check out the code or guess where a bug may be. It runs the program millions of times, observes what really takes place, and keeps whatever presses the target into code it hasn’t reached.

In Back to the Fuzzer II: Finding the Bugs LLMs MissBright Security CTO Bar Hofesh offers 4 factors LLM code evaluation does not change fuzzing for zero-day discovery:

• Scale: A single fuzzing project runs 1 million to 10 million concrete inputs versus the put together target. At about 2,000 tokens per reasoned test case, matching one million executions with an LLM would take about 2 billion tokens for one target, and each of those test cases would still be a forecast.
• Speed and Ground Truth: A consistent harness runs hundreds to a couple of thousand inputs per 2nd per employee, throughout a number of parallel employees, so one million executions take minutes to 10s of minutes. One LLM thinking pass over one hypothesis takes numerous seconds, so one million would take months. The fuzzer likewise observes genuine habits, such as a sanitizer reporting a load checked out one byte out of bounds. An LLM needs to forecast how assembled code acts, consisting of struct designs, integer widths, allocator habits and construct flags that aren’t noticeable in the source.
• Protection: STAR Fuzzer’s libxml2 harness reaches about 13,600 code areas in a 5-million-execution run. Protection feedback programs which areas each input reached, and inputs that reach brand-new code ended up being beginning points for much deeper search. Code evaluation has no comparable signal for just how much of a big parser it has really covered.
• The Unexpected: LLMs, code customers and fixed analyzers try to find the very same recognized patterns, so in fully grown code the majority of those bugs are currently repaired. The fuzzer has no expectations about where a bug must be. The target’s own habits chooses what is intriguing.

Reproducibility is the other distinction. Lots of plausible-looking LLM findings do not replicate, and maintainers require a reproducer before they can act. A fuzzer finding is a reproducer by building, and Bright Security replays each in a fresh container before submitting it.

How STAR Fuzzer Works

STAR Fuzzer’s online search engine drives any target through a little harness over IPC, so the code under test can be composed in C, C++, Rust, Go, Java, Kotlin, Crystal, Node or any language that can check out an input and report back.

• Structure-aware parsing without any per-target grammar: Every seed is parsed into a typed tree of fields by a format-agnostic parsing layer, and the tree serializes back to the initial bytes precisely. No grammar or dictionary file is composed per target, and each format contributed to the parsing layer enhances every target that utilizes it.
• Anomalies that surpass the very first check: Byte-level anomaly mainly produces inputs a parser declines at its very first peace of mind check. Altering the fields of a legitimate structured input keeps most executions past framing and recognition, so the screening spending plan is invested in the much deeper reasoning behind them.
• Development with specific replay: Each organism in the population brings a genome, a purchased list of anomalies. Each date, organisms alter, run and are scored. Improvements are kept, ineffective modifications are gone back, and organisms reproduce. Replaying a genome recreates its payload precisely, so every outcome can be regrowed from a logged random seed.

Arise From Open-Source Testing

Before release, Bright Security ran STAR Fuzzer for 2 days in an automatic pipeline versus numerous open source jobs, from libraries and applications to low-level binary parsers. 45% of the tasks evaluated had High or Critical concerns, and 37% of the susceptible tasks become part of Google’s OSS-Fuzz program.

In its very first month of accessibility, STAR Fuzzer produced 10 released findings in 8 jobs composed in C, Go, JVM languages and Crystal. Each was replayed in a fresh container before filing:

• TwelveMonkeys: In the DDS reader, the mipMapCount header field sizes an uncapped range, so a 38-byte file requires a multi-gigabyte allotment (CWE-789). GHSA-fwp7-38wp-mmxw, repaired in 3.15.0.
• Fider: Publish recognition checks an image’s compressed size, then totally deciphers it, so a 436 KB PNG broadens to about 562 MB. Any validated user can activate it (CWE-409). STAR Fuzzer discovered it in about 12 minutes, in a release currently benchmarked by several AI pentesting suppliers. GHSA-7cw3-7xh9-529r, repaired in 0.38.0.
• Crystal basic library (XML): XML:: Node #namespace type confusion. ENTITY_DECL is missing out on from an allowlist, so a field of libxml2’s xmlEntity struct reads as an xmlNs * (CWE-843). GHSA-c267-9cqj-hv9f, repaired in Crystal 1.21.1.
• Crystal basic library (YAML): YAML:: Any #hash overruns the stack on a self-referencing anchor and alias cycle. An 88-byte input triggers an uncatchable SIGSEGV (CWE-674). GHSA-fj8w-2r88-5v7w, repaired in Crystal 1.21.1.
• libsolv: 2 vulnerabilities, CVE-2026-104621 and CVE-2026-104622. Information are under embargo.
• htop: An out-of-bounds read in the/ proc/PID/stat parser, brought on by a missing out on bounds look at field 22 (CWE-125). Repaired (# 2101).
• universal-ctags: A null-pointer member gain access to in foreachEntriesInScope (CWE-476). Repaired in devote 780bd7a (# 4497).
• scrimage: An uncapped width-times-height pixel count lets a 35-byte GIF trigger allowance efforts of about 2 GB, and over 8 GB in a 2nd variation (CWE-789). Repaired in 4.6.8 (# 893).
• RIOT OS: An off-by-one in _ dirlist_cb (link_format. c). The bounds examine pursue the compose, so a NUL byte lands one past the buffer (CWE-193). Repair sent in PR # 22879.

Numerous of these bugs being in code that looks proper on evaluation. The Fider upload has a size limitation, however it determines compressed size. The TwelveMonkeys field checks out as image metadata, not as a length. The Crystal allowlist looks total. The YAML hash function is proper for trees, and the bug is a cycle in the input.

The complete approach and outcomes are released in 2 parts: Part I on brightsec.com, and Back to the Fuzzer II: Finding the Bugs LLMs Miss by Bar Hofesh.

Where STAR Fuzzer Fits Best

STAR Fuzzer by Bright Security is created for groups whose code manages untrusted input listed below the HTTP layer, consisting of:

• Applications that process uploaded files, images, files or archives
• Parsers, serialization code and raw binary procedures
• Non-web software application such as ingrained and IoT firmware, desktop applications and backend services
• Codebases with a growing share of AI-generated code that requires screening beyond pattern matching
• Security groups that wish to verify fixed analysis (SAST) findings by working out the flagged functions live

It supports C/C++, Rust, Go, Java/Kotlin,. INTERNET, Node, Python and Crystal, and runs inside the client’s environment without any running application, cloud scanner or authentication needed. In consistent mode, harness execution has to do with 51 times faster than running a brand-new procedure per input.

Executive Perspectives

“Fuzzing has actually constantly discovered the bugs that matter most, the ones that take a service down or corrupt memory, however it has actually been too costly for a lot of groups to run,” stated Bar Hofesh, Co-founder and CTO of Bright Security“The search was never ever the traffic jam. The harnesses and the triage were. STAR Fuzzer automates both, so the evolutionary engine we integrated in 2018 can lastly stumble upon an entire codebase.”

“When Nevada opened the Boulder City Bypass in 2018, it took navigation apps months to begin sending out motorists down it,” Hofesh included. “LLMs auditing code work the very same method. They discover the bugs they’ve currently seen. The zero-days that have actually lived for several years in fully grown code are the ones no one has actually seen before, which’s precisely where a fuzzer shines.”

“Security groups are being asked to stay up to date with code composed faster than ever, much of it by AI,” stated Gadi Bashvitz, Co-founder and CEO of Bright Security. “Testing that just looks where bugs are anticipated will not keep up. STAR Fuzzer looks all over else, and it hands designers the evidence they require to repair what it discovers.”

“AppSec groups keep asking us the exact same thing: if AI is composing more of our code, what’s checking the parts AI can’t, see?” stated Eyal Dror, CMO of Bright Security. “STAR Fuzzer is our response. In its very first month it discovered 10 genuine bugs in fully grown open-source tasks, and everybody featured the specific input that activates it. That’s evidence a designer can act upon the very same day, not another alert to argue about.”

Accessibility

STAR Fuzzer is offered now as a mode of Bright STAR. Find out more and book a demonstration at brightsec.com/fuzzer

Regularly Asked Questions:

What is Agentic Fuzzing? Agentic fuzzing utilizes AI representatives to automate the judgment-heavy actions of fuzzing: picking which works to check, composing and validating harnesses, and triaging outcomes. The fuzzing itself is carried out by an online search engine that alters inputs to activate faults.

How is STAR Fuzzer Different from AFL++ or libFuzzer? AFL++ and libFuzzer are fuzzing engines that require engineers to compose a harness for each target and to triage crashes by hand. STAR Fuzzer by Bright Security picks targets, produces and confirms harnesses, triages faults for reachability and effect, and provides findings in a pull demand with a replicating payload.

Can LLMs Find Zero-Day Vulnerabilities in Parsers? LLMs work at recognized bug classes, such as an unattended memcpy length or string-built SQL, however they look where their training states bugs must be. In fully grown code, the bugs that make it through are the ones that match no recognized pattern, which is where evolutionary, coverage-guided fuzzing is greatest.

Why Use a Fuzzer Instead of LLM Code Review? A fuzzing project runs countless genuine executions versus assembled code and observes what takes place, while an LLM anticipates habits from the source. Matching one million executions with LLM thinking would take about 2 billion tokens per target. Every fuzzer finding likewise includes an input that replicates it.

How are STAR Fuzzer Findings Verified? Every finding includes a byte-exact payload that replicates it, and Bright Security replays every one in a fresh container before submitting it. Any outcome can likewise be regrowed from a logged random seed.

Does STAR Fuzzer Need Grammars or Dictionary Files? No. A format-agnostic parsing layer turns each seed into a typed tree of fields, so no per-target grammar or dictionary is needed.

Does STAR Fuzzer Replace DAST? No. DAST checks a running application from the outdoors in, over HTTP. STAR Fuzzer tests security-critical functions from the within out, without a running application. Intense STAR runs both, with the exact same representative and the very same pull-request output.

What Kinds of Bugs Does STAR Fuzzer Find? Crashes, hangs, out-of-memory conditions and unbounded allowances, memory-safety bugs such as out-of-bounds checks out and off-by-one composes, type confusion, stack overflows from recursive input structures, and algorithmic-complexity blow-ups, consisting of decompression bombs set off by inputs of a couple of lots bytes. Which languages does STAR Fuzzer Support? C/C++, Rust, Go, Java/Kotlin,. WEB, Node, Python and Crystal. 19659068 About Bright Security 19659069 Bright Security is the Agentic Offensive Application Security business, assisting companies safe and secure software application at the speed of AI-driven advancement. Its AI-powered Bright STAR platform incorporates security straight into the advancement lifecycle, automating detection, removal and recognition throughout web applications, APIs and code, and fitting into both designer and AppSec workflows. Previously called NeuraLegion, Bright Security is headquartered in California. Find out more at brightsec.com 19459037 Contact CMO Eyal Dror Bright Security Inc [email protected] 19659075 19659076