What it is
The Security Lab Taskflow Agent is GitHub Security Lab’s open-source framework
for running structured, AI-assisted source-code audit tasks. GitHub says its
2026 campaign used gpt-5.x for code analysis, then required Security Lab
researchers to reproduce, assess, and manually triage candidate findings before
reporting them.
What is verified
Bugflation’s audit found 43 public GHSL advisory pages attributable to the Taskflow campaigns documented by GitHub. Twenty-four pages explicitly say “Taskflow Agent” and nineteen use the earlier or more generic “AI agent developed by GitHub Security Lab” credit. GitHub’s CodeQL-triage and general audit articles identify both groups as Taskflow workflows and link the published advisory set.
Together, these pages contain 24 unique CVE IDs plus 24 accepted security reports without CVEs across 23 no-CVE advisory pages. The CVE-backed set spans thirteen projects, while the accepted no-CVE set spans web applications and GitHub Actions workflows in twenty projects.
This is direct primary-team attribution. The advisory pages document the accepted issues, while GitHub’s methodology articles document the AI workflow and the human validation boundary. Two 7-Zip advisory pages appear in GitHub’s AI-agent index without naming Taskflow or another system on the individual pages, so Bugflation keeps those under a separate system-unspecified profile.
Why it matters
Taskflow demonstrates that AI-assisted auditing is expanding beyond native-code memory safety into authorization, data exposure, XSS, CSRF, and business-logic flaws. Its published filtering statistics also make the validation burden visible rather than treating every model suggestion as a vulnerability.