BRIGHT Security has launched STAR Fuzzer, an agentic fuzzing mode that automatically identifies security-critical functions, generates per-function harnesses, and issues byte-exact payloads to reproduce every confirmed finding. In its initial open-source research run, STAR Fuzzer found High or Critical issues in 45% of tested projects and produced ten published findings in its first month across eight projects, including the Crystal standard library, htop and RIOT OS.
The tool operates without a running application, using an evolutionary search aided by AI to select targets, build harnesses, and triage results, delivering a reproducible payload in a pull request. It works with C, C++, Rust, Go, Java, Kotlin, Crystal, Node and other languages via a format-agnostic parsing layer and an IPC-based harness, without requiring per-target grammars or dictionaries.
STAR Fuzzer is positioned as a complement to AFL++/libFuzzer and DAST: it tests security-critical functions on untrusted-input paths, auto-generates and verifies harnesses, and replays pills to prove reachability and impact. Early findings include CVE-linked issues and vendor-identified fixes such as GHSA-fwp7-38wp-mmxw (TwelveMonkeys, fixed in 3.15.0) and GHSA-7cw3-7xh9-529r (Fider, fixed in 0.38.0).
Other notable results cover Crystal XML (CWE-843; Crystal 1.21.1) and YAML (CWE-674; Crystal 1.21.1), with additional items in libsolv (CVE-2026-104621/104622), htop (CWE-125; fix #2101) and RIOT OS (CWE-193; PR #22879). The findings are reproducible in fresh containers, and the full methodology is published across Bright’s Part I findings and related analyses. Availability is as a mode within Bright STAR, with claims that persistent mode yields about 51× faster harness execution.