GitHub researcher reports 24 Android flaws found with AI audit workflows

A GitHub security researcher says AI audit workflows helped find and report 24 vulnerabilities in Android apps. In disclosed examples, a flaw in OsmAnd could let another app silently change map settings to expose location and route data. Two flaws in Wikipedia's Android app could be combined to send account cookies to an attacker-controlled page. The open-source workflows guide a model through app entry points and likely vulnerability classes. Running them requires a GitHub Copilot license and can consume many premium model requests. The researcher says security specialists still need to review findings because the model can misjudge severity and overlook mitigating factors.