GitHub's Security Lab has revealed that its open-source AI security agent discovered 24 vulnerabilities in Android applications, including a potential for covert location tracking in OsmAnd and account takeover threats against Wikipedia for Android This article explores threats wikipedia android. . The findings underscore how targeted AI workflows can reveal complex mobile logic flaws, while still requiring human validation.
The research utilized the GitHub Security Lab's Taskflow Agent, an open-source framework designed to automate and share AI-assisted security research workflows. Instead of asking a large language model to scan an entire repository with a general prompt, researchers created Android-specific taskflows that broke down audits into smaller stages. Another taskflow evaluates each entry point against Android-specific vulnerability classes, including insecure intents, confused deputy problems, unsafe broadcasts, cross-app scripting, and WebView risks.
This vulnerability enabled an attacker to exploit a malicious domain like evil-wikipedia.org, which could pass the suffix check due to its name ending with wikipedia.org. Researchers warned that the stolen data could include usernames, long-lived authentication tokens, and session tokens valid across Wikimedia projects, including Wikipedia, Wikimedia Commons, Wikidata, and Meta. GitHub requires a GitHub Copilot license for users, and audits can consume significant premium model requests due to the processing time for medium-sized repositories, which can take anywhere from one to two hours and necessitate multiple tool calls.
