Bright Security starts an AI fuzzer that found bugs in 45% of projects

On 19 October 2026, Bright Security started STAR Fuzzer, a tool that finds crashes and memory bugs in code. A fuzzer sends millions of bad inputs to software to make it stop. The company tells that AI prepares the tests. It tells that a search that is not AI finds the bugs. In its first test of open source projects, 45% had High or Critical issues.

How it works

The tool uses AI to select the functions to test and to write a harness for each one. A harness is a small piece of software that sends inputs to the code to test. The company tells that the search is not a language model. It operates the software millions of times and keeps the inputs that touch new code.

The numbers

In the first month, the company gave 10 results for 8 projects, with htop and RIOT OS. One test campaign uses 1 million to 10 million inputs. The company tells that a language model uses about 2 billion tokens to do 1 million of them.

What is not known

All numbers come from the company. It gave no names of the projects and no count of incorrect alarms. It tells that it replays each result in a new container before it reports the result.

Insight: The AI prepares the test and a plain search finds the bugs

The company uses AI for the steps for decisions: the code to test, the harness and triage. It keeps a search that is not AI for the bug search. It tells that language models find only bug types that they know. The company seems to give results that you can test, and that is its product. Before you get such a tool, find out which step is AI and which step you can test.