Marc Andreessen is famously quoted saying that “being too early is the primary reason why qualified startups fail, not being too late”. This was almost the case for Bright 8 years ago, but we were able to pivot and build a real business providing value for many customers. Now, technology has caught up to our original vision and we are reintroducing the Bright STAR Fuzzer.
In 2018 after around a year of covert research on bio-mimicry and evolutionary behavior Bright (at that time NeuraLegion), released our product, an AI guided fuzzer way before AI was cool. This was before LLMs were a thing, and was around the time neural networks became a new fashion for visual analysis and text\speech recognition.
In our research we proved something interesting, security issues and bugs can be converged into, not discovered by accident, and behavior of a system can slowly degrade leading into a fault. Armed with this new understanding we created a generic structural fuzzer that needs no dictionary and uses an advanced evolutionary algorithm to converge into the most complex and hard to uncover issues.
The solution was live, we generated significant interest and won 1st place as The Most Interesting Technology in Israel’s CyberTech 2019 conference (“Winners of CyberTech competition as most innovative and disruptive solution, NexPloit is the world’s first AI-powered Application Security Testing solution”).
The only problem was, the world was not yet ready.
Conducting root cause analysis in a pre-LLM world meant digging into code that sometimes was a 3rd party library, it meant manually writing the harness by hand and deciding on what levers to pull.
The pivot wasn’t just about technical challenges. Our tool succeeded beyond expectations, attracting security agencies and offensive security firms, while we wanted to build for enterprise teams. So we listened to our customers and shifted toward developer-centric DAST.
The world finally caught up
2026 is nearing its end, and with it, the ability to automate root cause analysis, harness creation and runtime, and application containment on the fly has becaome a reality, and not just a reality, one that can actually scale up across an organization’s codebase.
With thoese new realities we decided to revisit our core technology and with careful consideration for the power and capabilities of what we built we created an automated harness around the algorithm and code, combining our fuzzer with Bright’s STAR agentic harness.
No longer would developers need to manually dig into root cause, they would not need to write their own fixes or understand complex low level handling, the pure power of Bright’s fuzzer just became a single click autonomous solution.
But before we could share it with the world, we needed to test it ourselves and prove that it works, and so we did.
Welcome to the ZeroDay Factory
We started by running the Fuzzer on multiple opens-ource solutions in an automated pipeline we created for two days. This included various , from libraries to applications, from web based technologies to low level binary parsers.
But as our CEO likes to say: words are words – and numbers are numbers, so let’s back up our claims:
Out of the projects we tested 45% had High or Critical issues, those span different vulnerability families from memory corruptions (read and write) to denial of service (memory bombs and process death) and others vulnerabilities including path traversal and escapes.
37% of the vulnerable projects are in Google’s own OSS-fuzz list, which means a decade of constant fuzzing and issue hunting still proves a viable “hunting” finding grounds for the Bright Fuzzer.
We already have a number of published advisories are already available for those who are interested at:
- TwelveMonkeys DDS OutOfMemoryError (38-byte file forces a multi-GB allocation) – GHSA-fwp7-38wp-mmxw, published, fixed in 3.15.0
- Fider image decompression-bomb OOM (436 KB PNG expands to about 562 MB) – GHSA-7cw3-7xh9-529r, published, fixed in 0.38.0
A few have been opened as public issues due to no disclosure policy:
- htop out-of-bounds read in the /proc/PID/stat parser – htop-dev/htop#2101, fixed
- universal-ctags null-pointer access in foreachEntriesInScope – universal-ctags/ctags#4497, fixed
- scrimage GIF decompression bomb (35-byte GIF forces a multi-GB OOM) – sksamuel/scrimage#893, fixed in 4.6.8
Most of the issues the fuzzer found are still undisclosed and will be shared and published when fixes will be published.
Numbers are great, but let’s for a second dig into the talk about Fider finding.
Fider has been the battle ground for AI PT companies showing their skills. A recent article from Doyensec compared XBOW v.s Aikido against the Fider app, each found its own share of issues and ran for hours and even days against the target using smart LLMs to find and detect all kind of vulnerabilities both from the web side and by code analysis.
After all of those findings Doyensec contacted Fider and reported the issues which were all fixed, a few more companies then followed suit which brought even more issues to be disclosed and fixed as well.
We took the latest version, the one which was battle tested against multiple companies using advanced LLMs and AI products and gave our fuzzer a run. It took around 12 minutes for it to find a 0day in the imaging processing logic which allows a tiny few bytes image to overload the server memory with GBs of allocations and take down a whole instance.
And this is the biggest point, while LLM based Pentesting solutions hunt for the mundane and expected, our fuzzer hunts for the unexpected and hard to find vulnerabilities, because in the new age of LLMs in which Pentesting has become a commodity, and AI can easily find vulnerabilities with a simple prompt, the unexpected which the AI fails to identify and detect becomes the new frontier of security research and testing.
To add a bit more here, the Bright fuzzer is conceptually an AFL fuzzer with many additional capabilities. It systematically generates inputs and executes software to discover crashes and other observable failures. In comparison, LLM based solutions like Codex, Claude and others can understand code, reason about potential vulnerabilities, write tests, execute tools and attempt to exploit weaknesses. These are very different capabilities that find different vulnerabilities.
Better Together, With STAR
Bright’s STAR provides an autonomous harness for vulnerability detection, remediation and validation, all in one flow. And this is where the fuzzer fits perfectly.
The new fuzzing mode in STAR uses Bright’s fuzzer to uncover deep and complex issues easily, detect and identify the root cause, fix the issues, then validate they are indeed fixed using the fuzzer replay functionality.
It can also validate SAST findings by live fuzzing of functions and parts of the target in the harness, ensuring real behavior handling and security issue focus instead of just noise and false positives from SAST analysis.
* Fider findings – PR view, full details showing the exploitation impact and payloads.
We will start sharing all the Bright fuzzer findings on a regular basis so follow Bright on all social channels to receive ongoing updates and stay tuned for my post next week.
