Bright Security Introduces STAR Fuzzer, Agentic Fuzzing That Writes Its Own Harnesses and Proves Every Finding – Latest Hacking News

Cyber Security / By

25

\"\"

San Rafael, United States, October 19th, 2026, CyberNewswire

Bright Security has unveiled STAR Fuzzer, an advanced agentic application fuzzer designed to automatically identify security-critical functions, generate fuzzing harnesses, and pinpoint faults using an evolutionary algorithm. In its initial open source research run, STAR Fuzzer identified High or Critical issues in 45% of the projects tested, producing ten published findings in eight projects within its first month of availability.

Bright Security, known for its offensive application security solutions, has integrated STAR Fuzzer into its Bright STAR platform. This innovative tool is now accessible at brightsec.com/fuzzer.

STAR Fuzzer utilizes AI agents to automate critical aspects of fuzzing, such as target selection, harness creation, and fault triaging. By combining AI with evolutionary search algorithms, STAR Fuzzer streamlines the fuzzing process, making it faster, more reliable, and evidence-based.

Key Advantages of STAR Fuzzer Over Traditional Fuzzers:

  • Scope of Testing: STAR Fuzzer targets security-critical functions on untrusted input paths automatically, as opposed to traditional fuzzers that require manually written harnesses.

  • Harness Generation: While traditional fuzzers rely on engineers to create and maintain harnesses, STAR Fuzzer automatically generates and verifies harnesses for each function using AI.

  • Search Strategy: STAR Fuzzer employs a structure-aware evolutionary search guided by coverage and multiple fitness signals, offering a more efficient approach compared to traditional fuzzers.

  • Independent Operation: Unlike traditional fuzzers that need a running application, STAR Fuzzer operates independently, enhancing its flexibility and usability.

  • Automated Triage: STAR Fuzzer automates the triaging process for fault reachability and impact, reducing manual intervention.

  • Output Delivery: While traditional fuzzers provide crash inputs and logs, and DAST returns vulnerability reports, STAR Fuzzer delivers detailed findings with byte-exact payloads in a pull request.

  • Fix Validation: Teams using STAR Fuzzer can easily validate fixes by replaying the payload, eliminating the need for manual re-runs.

Addressing the Limitations of Traditional Fuzzing Approaches:

STAR Fuzzer is designed to overcome the limitations of traditional coverage-guided fuzzers and DAST by focusing on security-critical functions and automating critical steps in the fuzzing process. By leveraging AI for target selection and harness generation, STAR Fuzzer offers a more comprehensive and efficient approach to identifying critical vulnerabilities.

Unique Approach to Finding Zero-Day Vulnerabilities:

STAR Fuzzer’s innovative approach to bug discovery sets it apart from traditional methods like LLM code review. By running millions of executions against compiled targets and observing real behavior, STAR Fuzzer can uncover zero-day vulnerabilities that elude conventional approaches.

Results from Open-Source Testing:

Prior to its official launch, STAR Fuzzer was put through rigorous testing against various open-source projects. The tool successfully identified High or Critical issues in 45% of the projects tested, including well-known projects like Crystal standard library, htop, and RIOT OS.

During its initial month of availability, STAR Fuzzer produced ten published findings in eight projects, showcasing its effectiveness in detecting vulnerabilities across different programming languages.

Conclusion:

STAR Fuzzer by Bright Security represents a significant advancement in agentic application fuzzing, offering a more efficient, automated, and reliable approach to identifying security vulnerabilities. With its AI-driven capabilities and evolutionary search engine, STAR Fuzzer is poised to revolutionize the field of application security testing.

About Bright Security:

Bright Security is a leading provider of offensive application security solutions, empowering organizations to secure their software in an AI-driven environment. The company’s Bright STAR platform integrates cutting-edge security measures into the development lifecycle, ensuring robust protection against cyber threats. Headquartered in California, Bright Security is committed to enhancing application security for businesses worldwide. Learn more at brightsec.com.

Contact

CMO
Eyal Dror
Bright Security Inc
[email protected]

Related Posts