What happened
On Oct 18 GitHub Security Lab published an open-source AI security agent (Taskflow Agent) and the targeted taskflows it used to find 24 Android vulnerabilities, including a location leak in OsmAnd and a Wikipedia account-takeover chain; the taskflows are runnable on any project.
Why it matters
A reproducible, open-source agentic vulnerability-scanning framework that found real production flaws (logic and trust-boundary issues) moves AI-assisted vulnerability discovery from demos to a usable OSS tool for defenders.
Applicability
AppSec and mobile security teams should evaluate the open-source taskflows against their own Android/Java codebases, while noting findings still require human validation of impact.