Boffins build automated Android bug hunting system

A2 is an agentic AI system developed by researchers to autonomously discover and validate Android app vulnerabilities; it reportedly achieved 78.3% coverage on the Ghera benchmark and found 104 true-positive zero-day vulnerabilities across 169 production APKs, with 57 automatically validated PoCs (including a medium-severity intent-redirect in an app with >10 million installs). The paper describes a planner/executor/validator architecture using multiple LLMs, provides per-APK and per-vulnerability cost estimates, and warns of dual-use risks where automated, validated findings could speed both defensive remediation and offensive exploitation.