[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-new-benchmark-tests-ai-agents-hunting-android-bugs":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},7356,"new-benchmark-tests-ai-agents-hunting-android-bugs","New Benchmark Tests AI Agents Hunting Android Bugs","MobileCybench pits five coding agents against 13 Android apps and finds they catch real vulnerabilities roughly a third of the time, even with source code.","AI agents can now find real security holes in Android apps on their own - but they still whiff more often than they hit.\n\nResearchers built MobileCybench, a benchmark that tests five coding agents (OpenCode running GPT-5.5, GPT-5.6-Sol, and GLM-5.2; Claude Code running Opus 4.8 and Opus 5) against 13 Android apps, using 495 hand-written \"probes\" that check whether a specific security property has been violated. Agents worked under four scenarios: posing as a malicious app on the victim's phone or as a remote attacker with a low-privilege account, each tried with only an obfuscated APK or with full source code. Given just the obfuscated app, the best performer, OpenCode with GPT-5.6-Sol, triggered probes in 53.8% of apps as a malicious app but only 16.7% as a remote attacker. Handing over source code raised the average trigger rate across all agents from 28.8% to 32.8% - a modest bump, not a breakthrough. The exercise also turned up 23 previously unreported vulnerabilities, most of which app maintainers have since confirmed.\n\nThat last number is the real story. Security teams already struggle to triage a flood of AI-generated vulnerability reports, and a framework that checks exploits against reusable, property-based probes - rather than matching them to already-known bugs - could cut through some of that noise by verifying reports automatically instead of by hand.\n\nStill, a benchmark where the top agent finds fewer than one in five bugs as a remote attacker is a reminder that \"AI hacks your phone\" headlines are running well ahead of the data.","[\"ai-agents\",\"android-security\",\"vulnerability-research\",\"benchmarks\"]","2026-09-23T04:00:00.000Z","2026-09-23T09:17:52.335Z","2026-09-23T09:17:58.658Z","published",null,[],"security",[26,27,28,29],"ai-agents","android-security","vulnerability-research","benchmarks",[31],{"name":32,"url":33},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2609.23980",0,{"sections":36},[37,41,44,49,54,58,62,67,72,77,82,87,92,97],{"name":38,"slug":39,"count":40,"latest_published_at":18},"AI","ai",4297,{"name":42,"slug":24,"count":43,"latest_published_at":18},"Security",710,{"name":45,"slug":46,"count":47,"latest_published_at":48},"Policy","policy",369,"2026-09-23T02:13:52.000Z",{"name":50,"slug":51,"count":52,"latest_published_at":53},"Deals","deals",202,"2026-09-22T23:00:04.000Z",{"name":55,"slug":56,"count":57,"latest_published_at":18},"Hardware","hardware",169,{"name":59,"slug":60,"count":61,"latest_published_at":18},"Science","science",133,{"name":63,"slug":64,"count":65,"latest_published_at":66},"Consumer Tech","consumer-tech",110,"2026-09-22T20:00:00.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Software","software",80,"2026-09-22T23:32:52.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Dev Tools","dev-tools",79,"2026-09-22T22:21:13.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Startups","startups",65,"2026-09-22T22:06:48.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Gaming","gaming",45,"2026-09-22T15:35:06.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"General","general",43,"2026-09-21T23:48:56.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"Reviews","reviews",27,"2026-09-22T13:00:00.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]