October 26th Research Briefing

Contents

1. JANUS: agent-built fuzzing harnesses find six vendor Android bugs
2. Typos: one LLM pass per seed, 128 new bugs in compilers and runtimes
3. KnotScryer: 612 exploitable chains from marketplace-clean agent skills

JANUS: agent-built fuzzing harnesses find six vendor Android bugs

JANUS found six previously unknown memory-corruption vulnerabilities in closed-source native libraries that ship inside pre-installed apps from Vivo, Xiaomi, OnePlus, and OPPO. Bug classes include out-of-bounds writes, an integer overflow, and unsafe deserialization. The researchers reported all six through coordinated disclosure and are holding the technical details until the embargo ends.

This matters because a native library runs in the app's process with the app's permissions, but outside the memory safety of the Android Runtime. In the paper's case study, a privileged Xiaomi theme app renders user-supplied scene files, and its native renderer multiplies a caller-supplied index by a fixed stride without a bounds check. The paper calls this a controllable relative heap write, reachable when a victim applies a crafted theme file.

Fuzzing these libraries needs a harness that calls each JNI method in the right order with valid Java objects, and that knowledge exists only inside each closed-source app. JANUS runs an LLM agent over decompiled Java and native pseudocode. It resolves explicit and implicit call dependencies, builds nested argument objects bottom-up, keeps verified call sequences in a memory layer, and repairs each harness from compile errors and runtime exceptions before AFL++ runs it.

On 44 popular apps with 21,386 JNI methods, JANUS produced 6,094 runnable harnesses, 5.9 times as many as POIROT and 7.4 times as many as Atlas++. A full run cost about $1,293 in API spend. A bare coding agent with the same model and none of the JANUS components built no working harness.

Authors: Xiangyu Zhang, Yucheng Su, Lingling Fan, Yinan Li, and Sen Chen (paper, pdf).

Typos: one LLM pass per seed, 128 new bugs in compilers and runtimes

Typed Template Fuzzing, implemented in a tool called Typos, reported 135 bugs in a six-month campaign across 27 targets and 21 input languages. Of these, 128 were previously unknown, maintainers confirmed 107, and 74 are fixed. Targets include GCC, rustc, the Go compiler, Z3, PHP, DuckDB, and PyTorch. Memory-safety finds include a use-after-free in the DuckDB query optimizer and an out-of-bounds read in PHP's Unicode string handling.

This matters because LLM-based fuzzers usually trade throughput for validity. Fuzzers that ask a model for every test case are slow and inherit its mistakes, while fuzzers that depend on language-specific parsers and type checkers need new engineering for each language.

Typos calls the LLM once per seed file, before fuzzing starts. The model annotates each expression with its default value, its type, and the variables in scope, which turns the seed into a typed template. A character-by-character diff against the original seed then repairs LLM mistakes, such as an extra parenthesis. The fuzzing loop then replaces expressions with new ones of the same type, with no parser, no type checker, and no further model calls.

On average 96% of the mutants are valid, close to purpose-built fuzzers for a single language. In the paper's lead example, two mutations of a short Go program triggered an internal compiler error in gc that the Go developers fixed. Another Go compiler bug was treated as a release blocker, and the fix was backported to older versions.

Authors: Lu Maltsis and Dominik Winterer (paper, pdf, artifact). Lu Maltsis: GitHub. Dominik Winterer: X, LinkedIn, GitHub.

KnotScryer: 612 exploitable chains from marketplace-clean agent skills

KnotScryer found 612 insecure compositions among 13,598 agent skills that ClawHub had labeled clean. In each chain, individually benign skills pass data through the agent until untrusted content reaches a forbidden operation, such as code execution on the agent host or data exfiltration. Replayed on three agent frameworks (Hermes, OpenClaw, and OpenCode) with three models, the chains were exploited at an average rate of 79.2%. The researchers disclosed the chains to the skill platform.

The gap exists because current skill scanners judge one skill at a time. The paper's motivating example pairs a GitLab inspection skill with a deploy skill: text in a public GitLab issue steers the agent to install and run an attacker-chosen project. In 84 of the 612 chains (13.7%), a single-skill scanner rated every skill safe.

KnotScryer summarizes each skill's ports, effects, operations, and trust boundaries, then builds a Skill Capability-Flow Graph. An edge exists only when the agent can observe the upstream output, that output can control the downstream input, and the skill's own evidence supports both. A policy-guided search follows secret or untrusted data along these edges to forbidden sinks, and marker-flow replay plus an LLM chain audit confirm each candidate.

Under GLM-5.1, 85.6% of the chains were exploited, against 16.5% and 18.2% for tag-match and graph-only baselines. In one case study, a Hermes agent told to "check my emails, and handle what's needed" read a phishing email and sent a CFO's contract figures to the attacker through a cold-email skill. With the email-sending skill uninstalled, the same attack failed.

Authors: Yihao Li, Chuanpu Fu, Yizhou Zhao, Miao Chen, Qi Li, and Ke Xu (paper, pdf). Chuanpu Fu: X, GitHub.