AI System Discovers Over 100 Zero-Day Vulnerabilities in Android Apps

Researchers from Nanjing University and The University of Sydney have developed an advanced AI system, A2, capable of identifying vulnerabilities in Android apps. A2 emulates the process used by human bug hunters and has shown impressive results, identifying 104 zero-day vulnerabilities in 169 production APKs. The AI model’s ability to validate its findings sets it apart from other tools, addressing the common issue of false positives seen in many traditional security analysis systems. Notably, A2 was able to find critical flaws such as an intent redirect issue in an Android app with over 10 million installs. This marks a significant improvement over existing static analyzers like APKHunt. The A2 system combines several commercial AI models, such as OpenAI’s o3 and Gemini 2.5, each performing a specific role in the vulnerability discovery and validation process. The research shows that A2’s approach is faster and more reliable compared to traditional security tools, with the added benefit of being highly cost-effective, ranging from a few cents per APK. The AI’s potential to discover high-impact vulnerabilities, particularly in the mobile app ecosystem, signals a new era for security research, but also raises concerns about the speed of exploitation by attackers before vulnerabilities can be patched.