October 11, 2026
Fuzzing Taskflow: agent writes C and C++ harnesses on its own and hunts for bugs
Fuzzing Taskflow, an agent for fuzzing C and C++ projects, was described in the GitHub Security Lab blog on Sep 24. It finds entry points itself, writes fuzzing harnesses, runs AFL++, and creates a vulnerability report for each unique bug.
GitHub
@github
Continuous fuzzing finds real bugs, but you still need a person who writes the harnesses, watches coverage and goes through every crash. GitHub Security Lab built Fuzzing Taskflow to hand this loop to an agent. Point it at a C or C++ repository. It will find entry points, work out the build, write harnesses, run the AFL++ fuzzer, read the coverage, and create a vulnerability report for each unique bug. See how the pipeline works from start to finish 🔍 https://github.blog/security/application-security/ai-powered-fuzzing-with-the-github-security-lab-taskflow-agent/
· 50.7K views
Fuzzing used to be run by a person: they wrote the harness (the wrapper that feeds inputs to a function), watched code coverage, and went through every crash. Now an agent runs this loop, and a person checks the result.
How to run it. Nothing to install: open the GitHubSecurityLab/seclab-taskflows-fuzzing repository in a Codespace and run ./scripts/fuzzing/run_fuzzing.sh PROJECT. Example from the blog: tukaani-project/xz.
Budget. The coverage loop doubles the time: 30, 60, 120, 240, 480, 960 seconds. That comes to about 32 minutes per target.
Model. Claude Sonnet 5 runs by default.
Verification. Patches are marked review required, because the agent may misread the code, and a person checks each patch. Run it in a disposable Codespace without elevated permissions: a prompt injection will get everything the user has access to.
Source