Bright Security launches STAR Fuzzer for automated vulnerability discovery
Bright Security has launched STAR Fuzzer, an agentic application fuzzer that automatically selects security-critical functions, creates test harnesses, and uses an evolutionary algorithm to find faults. Each confirmed issue comes with a byte-exact payload that can reproduce it. In early open source testing, the tool found high or critical problems in 45% of projects and produced findings in eight projects, including Crystal's standard library, htop, and RIOT OS.
Bright Security's STAR Fuzzer is a self-contained component of its STAR platform. It targets functions handling untrusted input, builds a harness for each, and verifies the harness reaches its intended target. Its search combines coverage with other fitness signals, while an evolutionary engine—first introduced in 2018—drives fault discovery.
In an initial open-source research effort, the tool reported High or Critical issues in 45% of tested projects. During its first month, it yielded ten published findings across eight projects, among them Crystal's standard library, htop, and RIOT OS. It detects crashes, memory exhaustion, and memory-safety defects without a running application.
Automated fuzzing tools like STAR Fuzzer could make vulnerability discovery more accessible to smaller open-source projects and under-resourced maintainers, potentially reducing exposure to memory-safety and availability bugs. If findings arrive with reproducible payloads, developers may patch faster and with less guesswork. Yet broader use may also increase report volume, placing additional triage pressure on volunteer maintainers. The societal effect may depend on how well projects absorb and prioritize these reports.