Bright Security has released STAR Fuzzer, an automated application fuzzer that discovered High or Critical security issues in 45% of projects tested during its initial open source research run. The company announced the official launch today, describing the tool as an "agentic" fuzzer that identifies security-critical functions on its own, builds a testing harness for each one automatically, hunts for flaws using an evolutionary algorithm, and delivers every confirmed discovery with the exact payload needed to reproduce it. In its first month of public availability, the tool produced ten published vulnerabilities across eight open source projects, including the Crystal standard library, htop, and RIOT OS.
During the pre-release testing period, STAR Fuzzer ran for two days in an automated pipeline against multiple open source projects spanning libraries, applications, and low-level binary parsers. Among the projects that contained High or Critical issues, 37% were already part of Google's OSS-Fuzz program. The ten vulnerabilities discovered in the first month included a type confusion bug in Crystal's XML library, a stack overflow triggered by an 88-byte YAML input, and a decompression bomb in Fider that let any authenticated user expand a 436 KB PNG to roughly 562 MB in memory. The Fider vulnerability was found in approximately 12 minutes, in a release that had already been examined by multiple AI penetration testing vendors. Several other findings involved uncapped allocations triggered by tiny malformed inputs—a 38-byte file forcing a multi-gigabyte allocation in TwelveMonkeys, and a 35-byte GIF triggering allocation attempts exceeding 2 GB in scrimage.
"Fuzzing has always found the bugs that matter most, the ones that take a service down or corrupt memory, but it has been too expensive for most teams to run," said Bar Hofesh, co-founder and CTO of Bright Security, in the announcement. "The search was never the bottleneck. The harnesses and the triage were. STAR Fuzzer automates both." According to the company's published methodology, traditional coverage-guided fuzzers like AFL++ and libFuzzer depend on engineers to write and maintain a harness for every target and to manually sort through the crashes that result, a cost that has kept fuzzing confined to specialist teams and a subset of critical projects. Bright Security replays every finding in a fresh container before filing it, and every result can be regenerated from a logged random seed.
The report explains that STAR Fuzzer applies AI agents to the parts of fuzzing that have historically required a specialist—choosing what to test, writing the harness, and deciding which crashes matter—while relying on an evolutionary search engine for the fuzzing itself. The approach is designed to keep judgment-heavy steps automated and the search fast, repeatable, and evidence-based. A single fuzzing campaign runs one million to ten million concrete inputs against the compiled target, and in persistent mode the tool executes inputs about 51 times faster than spawning a new process for each one. The evolutionary engine underlying STAR Fuzzer was first released in 2018 and uses structure-aware parsing without requiring a per-target grammar or dictionary file. Each seed is parsed into a typed tree of fields by a format-agnostic parsing layer, and mutations operate on those fields rather than raw bytes, keeping most executions past framing and validation so the testing budget is spent on deeper logic.
STAR Fuzzer is available now as a mode of the Bright STAR platform and supports C/C++, Rust, Go, Java/Kotlin, .NET, Node, Python, and Crystal. It runs inside the customer's environment without requiring a running application, cloud scanner, or authentication. The tool is designed for teams whose code handles untrusted input below the HTTP layer, including applications that process uploaded files, parsers, serialization code, non-web software like embedded firmware, and codebases with a growing share of AI-generated code. Bright Security positions it as complementary to dynamic application security testing, which tests running applications from the outside in over HTTP, while STAR Fuzzer tests security-critical functions from the inside out. The automation of harness generation and triage means organizations can now apply fuzzing across an entire codebase rather than limiting it to a handful of hand-selected targets. For teams increasingly reliant on code generation tools, the tool offers a way to verify behavior through millions of real executions rather than pattern-matching review alone.