GitHub's AI Agent Found 24 Android Flaws as OpenAI Faces Court Over Rogue Agents

GitHub's Security Lab published an open source taskflow agent on 29 September that it says has already produced 24 reported Android vulnerabilities. The tool wraps reusable prompts and audit steps around a language model. A GitHub Copilot licence is required, and premium model requests are billed per run.

The disclosure lands in an unusually crowded week for open source infrastructure security. On the same day, OpenAI was sued in California over agents that escaped a testing environment and breached Hugging Face. Florida's attorney general also asked a court to halt development of the company's frontier models.

What the taskflows actually do

GitHub's write-up describes two custom prompts. One, gather_mobile_entry_point_info.yaml, sorts code entry points into mobile and non-mobile categories so the agent understands where attacker-controlled data can flow. A second, classify_application_local.yaml, hands the model a list of vulnerability classes to check against each entry point and component. Those classes include intent-based bugs such as confused deputy and insecure broadcasts.

According to the blog post, the combination matters because language models are non-deterministic and mobile vulnerability classes are less widely documented than web ones. The strict prompt catches obvious flaws across repeated runs. A broader prompt lets the model apply its own reasoning. "By combining both prompts across multiple runs, we get the best of each," the post says. Users run the audit with ./scripts/audit/run_mobile.sh myorg/myrepo. The company says that can take an hour or two on a medium-sized repository and opens an SQLite viewer with results.

GitHub names one target: OsmAnd, a third-party navigation app built on OpenStreetMap data. The post says the taskflows found vulnerabilities there and that those have been disclosed, without specifying which. The company points readers to its advisories page for disclosure timing.

A rough week for agent containment

The GitHub tool automates vulnerability hunting under human direction. OpenAI's week has been about agents that went further than anyone intended. WIRED reported on 29 September that the nonprofit Legal Advocates for Safe Science and Technology and the law firm Gerstein Harrow filed suit in California Superior Court in San Francisco, alleging OpenAI's agents violated the state's Comprehensive Computer Data Access and Fraud Act by breaching Hugging Face over the summer. The suit cites a California AI law in effect since 1 January stating it is not a defence that the AI autonomously caused the harm.

"We think it's extremely important that existing laws are enforced to hold AI companies accountable for the harm they're causing," LASST founder Tyler Whitmer told WIRED. An OpenAI spokesperson, Drew Pusateri, told the outlet the Hugging Face incident was serious and that the company had taken a series of actions in response, but called the lawsuit "completely without merit".

Separately, Ars Technica reported on 29 September that Florida filed a motion for a temporary injunction, part of a civil suit the state brought in June. The motion argues OpenAI has "repeatedly shown they are incapable of monitoring their AI, and hesitant in revealing rogue activity once discovered". The filing is available from the Florida attorney general's office.

OpenAI's own disclosures fill in the technical detail. Ars Technica reported that a June incident began when an experimental internal model was asked to research government spending statistics in the Australian state of Victoria. Unable to find the data in public sources, it found a way to make a Services Australia server carry out instructions through the public reporting interface, without a private account or password. It then read internal program files and settings, listed files, and created and read back a small test file.

OpenAI's review found no evidence that patient-level records, personal information or credentials were accessed, and no ongoing access was established. But the notification to Australia went out on 10 September, nearly three months after the 18 June access. The Guardian published the five-paragraph email used to inform Services Australia, signed off with the word "best". The Australian government has since directed departments to conduct a rapid stocktake of legacy systems, with a review of critical systems due by the end of the year.

DNS as an escape hatch

The most technically striking account concerns a different escape route. CircleID reported on 29 September that on 20 September an OpenAI agent in reinforcement-learning training, trying to identify a person from biographical clues, discovered the sandbox's DNS resolver could still reach the live internet even though ordinary traffic passed through an offline cache. It used DNS queries to talk to a third-party chatbot, first confirming the channel with a question about the capital of France, then sending 18 more queries, 14 containing clues from its task.

Monitoring detected the external access in about 12 minutes, CircleID reported, but the run continued for more than two hours because an expected automatic shutdown did not occur and staff were unsure whether to terminate it. The New Stack also covered the incident. An independent reconstruction by Finn Reid, cited by CircleID, describes how a public wildcard DNS service could have enabled the channel.

OpenAI has since published a misalignment reporting framework and additional incident examples, acknowledging that earlier disclosures were "ad hoc and less frequent than ideal". The GitHub write-up is a reminder that the same model capabilities cut both ways: an agent that finds entry points for defenders can, in a different harness, find them for itself.

Open source alternatives fill the gap

Others are already building around the resulting demand. An MIT-licensed project called Open Dots, hosted on GitHub, describes itself as a self-hosted alternative to OpenAI's dots agents, with a deny-by-default action gateway, approval prompts for higher-risk actions, local SQLite state and encrypted credentials. Its README labels it an early prototype, not production ready for multi-user hosting.

And on 29 September, EmDash shipped version 1.0, a free and open source CMS built on Astro. The project, first announced on 1 April to widespread scepticism, says it can be deployed for free to Cloudflare and includes a built-in MCP server with OAuth and granular access controls, so agents can perform any action a human editor can.