Bright Security has launched STAR Fuzzer, an agentic application security tool designed to automate the identification of critical functions, harness generation, and fault detection. The platform utilizes an evolutionary algorithm to search for vulnerabilities, including memory-safety bugs and crashes, without requiring a running application.
The tool supports multiple programming languages, including C, C++, Rust, Go, Java, Kotlin, .NET, Node, Python, and Crystal. In persistent mode, the system executes harness operations approximately 51 times faster than standard process-based testing. It operates independently of cloud scanners or authentication requirements.
During initial testing, STAR Fuzzer identified High or Critical issues in 45% of the projects analyzed. Within its first month of availability, the tool produced ten confirmed findings across eight open-source projects, such as the Crystal standard library, htop, and RIOT OS. Each finding includes a byte-exact payload for reproduction.
The company positions the tool as a solution for automating tasks traditionally handled by security specialists, such as manual harness writing and crash triage. By integrating AI agents for target selection and verification, the system aims to address vulnerabilities that often bypass LLM-based code reviews and traditional DAST methods.
