Academics Build AI-Powered Android Vulnerability Discovery and Validation Tool

Two academic researchers from Nanjing University and the University of Sydney have built a framework called A2 that uses AI to discover and validate vulnerabilities in Android applications. The system mimics human analysis by first reasoning about an app’s security and then validating each potential flaw through exploitation attempts.

It combines semantic code understanding with traditional security tools during the discovery phase and employs a PoC planner, executor, and validator to guide and verify exploitation-based validations. When fed an APK, A2 uses LLMs to analyse code, supplements findings with static analysis warnings, and aggregates discoveries for further processing. In testing with 160 APKs, 136 speculative vulnerabilities were reported, of which 60 were validated as exploitable defects and 29 were false positives.

The researchers report detection-only costs under $1 per APK, with full validation costs potentially up to $26.85 per vulnerability in Gemini (median $8.94).