Exfault is an AI-powered Android app pentesting tool that uses autonomous agents to find vulnerabilities through static and dynamic analysis, real emulator testing, and automatic app acquisition via package name.
Background
- The author is presenting Exfault, an AI-powered security testing tool that automatically hunts for vulnerabilities in Android mobile apps.
- "Agentic" refers to autonomous AI agents that can independently navigate an app, use security testing tools, and decide what to investigate — rather than just running preset checks.
- Key tools mentioned: adb (Android Debug Bridge, for device control), jadx and apktool (reverse engineering Android apps), Frida (dynamic instrumentation, for inspecting app behavior at runtime), Hermes-dec (decompiler for React Native apps, a common mobile framework).
- "Vibe coding" is a recent term (coined by Andrej Karpathy) for rapidly building software using AI code generators, which can lead to security oversights.
- This fits a broader trend of AI-native security tools for web apps (e.g., PentestGPT, HackerOne's AI) now expanding into mobile — a space the author argues is underserved.