GitHub Security Lab built an open-source AI security agent called the Taskflow Agent to automate, package, and share the LLM prompts and stepwise workflows that improve vulnerability hunting. The core argument is that customized taskflows - breaking auditing into incremental steps and steering the model toward specific classes of issues - lets LLMs find complex or easily-missed vulnerabilities faster. For Android, the team created targeted taskflows that separate mobile entry points from non-mobile code and that instruct the model to evaluate common mobile vulnerability classes, helping the agent focus on the correct attack surface and reasoning patterns.
Using these Android-focused taskflows against real apps produced dozens of findings (24 Android vulnerabilities reported), including several high-impact bugs and advisories now disclosed. The taskflows are available in the seclab-taskflows repo and can be run in a Codespace; a Copilot license and premium model requests are required, and runs can take one to two hours and consume many tokens. To audit a repo, execute ./scripts/audit/run_mobile.sh myorg/myrepo and inspect the audit_results table in the generated SQLite file for rows flagged as vulnerable.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Google has announced that Chromebook update support will end in 2034, breaking its previous promise of 10 years of updates for all devices. This change affects those who bought Chromebooks in recent years, raising concerns over corporate transparency and device longevity. (osnews.com)
Russian missile strikes have taken out several popular piracy websites. The attacks are linked to the ongoing Russo-Ukrainian war. (tomshardware.com)
A U.S. immigration advocate sued the government after a border agent searched his phone without a warrant and copied data. He believes the government targeted him due to his activism and political work on immigration rights. (arstechnica.com)
Over 44,000 legal objections have been filed against Palantir's NHS data platform, demanding it be blocked from handling medical data. The campaign follows backlash over the company's involvement with the Israeli military and US immigration enforcement. (theguardian.com)
OpenAI claims that a Chinese AI model stole its intellectual property. The company alleges that it had previously appropriated IP from other sources. (theregister.com)
Android developers face new requirements to publish apps, including a $25 verification fee and identity verification, even for small-scale projects. These policies have caused frustration among developers who want to share their apps freely without extensive registration processes. (twitter.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.