GitHub Security Lab open-sources Fuzzing Taskflow: an LLM agent runs the C/C++ fuzzing loop from harness writing to vulnerability reports

GitHub Security Lab's Fuzzing Taskflow (MIT, built on the Taskflow Agent framework) automates the human loop of continuous fuzzing for C/C++ projects. Given an owner/repo slug, the agent installs AFL++, clones the repo, picks entrypoints, writes harnesses, fuzzes, reads real coverage, and improves harnesses until a plateau, then triages crashes. Architecture: a shell driver, one taskflow YAML per stage, and MCP tools for execution; the agent decides, tools execute, and state lives in SQLite. Each harness is built as an AFL-instrumented binary and a coverage binary. Budgets double from 30s to 960s per iteration (~32 min/target) with a default 1% line-coverage plateau threshold. Structure-aware mutators cover JSON, XML, regex, PNG and TLV, plus source-derived dictionaries that grow toward uncovered guards. Crashes are minimized, ASan-replayed, deduplicated by stack-top hash, and written up with root cause, reachability, exploitability, a suggested diff and a regression-test sketch, marked review required. GitHub published no bug-count benchmarks. Claude Sonnet 5 is the default model. Run it only in a Codespace or throwaway VM because LLM-chosen build commands execute on the host.