# GitHub Security Lab AI Agent Uncovers 24 Android App Vulnerabilities, Including OsmAnd Location-Tracking Flaw and Wikipedia Account Takeover

> GitHub Security Lab used its open-source Taskflow Agent, an LLM-driven structured security-auditing framework, to discover 24 vulnerabilities across Android applications. Two are detailed: an OsmAnd (10M+ downloads) flaw where an exported MapActivity handling deeplinks and settings files lets a malicious app harvest a victim's precise location via unvalidated intent extras, and a logic bug in the Wikipedia Android app's deeplink handler enabling phishing and session hijacking via cookie theft across Wikimedia projects.

- **Published:** 2026-09-28T00:00:00Z
- **Last reviewed:** 2026-09-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2744
- **ID:** TL-2026-2744
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GitHub Security Lab publicly detailed the results of running its open-source Taskflow Agent — a YAML-driven, LLM-backed structured security-auditing framework built on the OpenAI Agents SDK — against a set of Android applications, surfacing 24 vulnerabilities. The agent is invoked via `./scripts/audit/run_mobile.sh myorg/myrepo` inside GitHub Codespaces, requires a GitHub Copilot license for its premium model requests, and typically completes a medium-sized repository audit in 1-2 hours. Two Android-specific taskflows drove the analysis: `gather_mobile_entry_point_info.yaml`, which separates mobile from non-mobile entry points, and `classify_application_local.yaml`, which focuses the model on mobile-specific vulnerability classes such as intent confusion and insecure broadcasts.

The post details two findings with clear real-world impact. First, OsmAnd (10M+ downloads) exports an Activity, `MapActivity`, that handles both deeplinks and settings-file imports. Its `handleOsmAndSettingsImport()` handler accepts intent extras (`settings_version`, `silent_import`, `replace`, `export_type_list_key`) that were only ever meant to arrive from a trusted in-process AIDL service — but because the Activity is exported, any application installed on the device can send it an Intent carrying arbitrary extras. A malicious app can import a crafted malicious tile-source configuration pointing at an attacker-controlled domain (`{ATTACKER_DOMAIN}/tiles/{z}/{x}/{y}.png`); every subsequent map-tile request OsmAnd makes then leaks the tile coordinates (i.e., the victim's precise latitude/longitude), plus route origins, destinations, and timestamps, to the attacker's server — silently, with no user-visible indication of compromise.

Second, the Wikipedia Android app contains two chained logic bugs. Its deeplink handler validates the authority of a `wikipedia://` URI only by checking `endsWith(WikiSite.BASE_DOMAIN)` rather than exact-matching a trusted domain, so a deeplink such as `wikipedia://evil-wikipedia.org` passes validation and is rewritten to a standard `https://evil-wikipedia.org` URI that the app then opens. Separately, `SharedPreferenceCookieManager.kt` validates cookie domains using the same overly permissive `.endsWith()` comparison. Chained together, a victim who taps a single malicious deeplink has the Wikipedia app auto-open attacker-controlled content and leak cookies to it — yielding the victim's username, long-lived tokens, and session tokens valid across every Wikimedia project (all Wikipedias, Commons, Wikidata, Meta, and more), enabling account takeover.

GitHub Security Lab states the two detailed findings were 'already disclosed,' but the post supplies no CVE identifiers, CVSS scores, patch status, or remediation timeline for either issue, and gives only high-level categories (path traversal, cross-app scripting in WebView implementations, exposed JavaScript bridges) for the remaining 22 undetailed vulnerabilities, pointing readers to GitHub Security Lab's advisories page for further detail. The post also documents the Taskflow Agent's current limitations: LLMs struggle to estimate severity accurately, produce false positives requiring human security-researcher validation, and can misjudge complex mitigating factors (e.g., internal vs. external storage data-priority hierarchies) without explicit proof-of-concept prompting — while showing strong knowledge of platform API behavior across languages without needing source-code access.

## MITRE ATT&CK

- T1660 Phishing
- T1559 Inter-Process Communication
- T1204.001 Malicious Link
- T1516 Input Injection
- T1635.001 URI Hijacking
- T1539 Steal Web Session Cookie
- T1430 Location Tracking
- T1430 Location Tracking
- T1409 Stored Application Data
- T1437.001 Web Protocols

## Sources

- [How we found 24 Android vulnerabilities using our open source AI security agent](https://github.blog/security/how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent/)
- [GitHubSecurityLab/seclab-taskflow-agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent)
- [GitHubSecurityLab/seclab-taskflows — example taskflows for the Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflows)
- [seclab-taskflow-agent README (v0.0.9)](https://github.com/GitHubSecurityLab/seclab-taskflow-agent/blob/v0.0.9/README.md)
- [AI-supported vulnerability triage with the GitHub Security Lab Taskflow Agent](https://github.blog/security/ai-supported-vulnerability-triage-with-the-github-security-lab-taskflow-agent/)
- [AI-powered fuzzing with the GitHub Security Lab Taskflow Agent](https://github.blog/security/application-security/ai-powered-fuzzing-with-the-github-security-lab-taskflow-agent/)
- [Community-powered security with AI: an open source framework for security research](https://github.blog/security/community-powered-security-with-ai-an-open-source-framework-for-security-research/)
- [OsmAnd MapActivity.java (source)](https://github.com/osmandapp/OsmAnd/blob/master/OsmAnd/src/net/osmand/plus/activities/MapActivity.java)
- [GitHub announcement: Taskflow Agent open-sourced for Auth Bypasses, IDORs, Token Leaks](https://x.com/github/status/2036172386974794192)
- [AI Agents | GitHub Security Lab — All advisories discovered with AI agents](https://securitylab.github.com/ai-agents/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2744