x.comthreadBadger Signal (@BadgerSignalHQ) on X
A Twitter thread from BadgerSignalHQ summarizing a blog writeup claiming GitHub Security Lab used AI-driven audit agents to find 24 vulnerabilities across popular Android apps. It describes an OsmAnd exported-activity flaw letting any app hijack map tile URLs to leak GPS location and route data without location permissions, and a Wikipedia account-takeover chain combining a deeplink hostname-parsing bug with weak cookie-domain checks to trigger malicious WebViews that exfiltrate session tokens across Wikimedia projects.
TL;DR Thread claims AI agents found 24 Android app vulns, including an OsmAnd location-leak and a Wikipedia WebView account-takeover chain.
Organisations named here
- GitHub Security Lab
- Wikimedia
Technologies named here
- OsmAnd
- open-source AI taskflows
- Wikipedia
- Android
Techniques named here
- Silent Location Tracking via exported activity hijacking
- Account Takeover via deeplink/cookie chaining
Related in AI Security
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
github.comadvisoryFlowise MCP Security Bypass Enables RCE
github.comrepoYesWeHack Claude Kit
jfrog.comarticle