AI system
- System
-
Spark, AI test agent in Code Intelligence's CI Fuzz (invoked as 'cifuzz spark')
- Model
-
Not assessed
- Release
-
Not assessed
- Application developer
-
Code Intelligence GmbH - Role
-
Not assessed
- Configuration
-
Not assessed
- Inputs and outputs
-
Not assessed
- Autonomy
-
Not assessed
- Workflow
-
wolfSSL's source tree (before 5.7.6) set up as a CI Fuzz project by the vendor. A single “cifuzz spark” command, after which the agent chose pem_read_bio_key() as a target and generated and ran a fuzz test. A sanitizer-detectable heap use-after-free in the BIO write-back path of pem_read_bio_key() that a generated input could trigger. A maintainer team that tracked the report as ZD#18875 and merged a fix within three days of the discovery.
- Human oversight
-
Not assessed
- Relation to AI
-
On the vendor's account, Spark selected the target, generated the fuzz test and ran it after a single “cifuzz spark” command. One manual step confirmed that the finding was real and exploitable under narrow conditions. wolfSSL's pull request and release notes confirm the bug, its location in pem_read_bio_key(), the timing and the reporter's first name. They mention neither AI nor Code Intelligence. The autonomous discovery therefore rests on the vendor's statements, repeated by QA Financial and SC Media, not on an independent test.
- AI contribution
-
On the vendor's account, Spark selected the target, generated the fuzz test and ran it after a single “cifuzz spark” command. One manual step confirmed that the finding was real and exploitable under narrow conditions. wolfSSL's pull request and release notes confirm the bug, its location in pem_read_bio_key(), the timing and the reporter's first name. They mention neither AI nor Code Intelligence. The autonomous discovery therefore rests on the vendor's statements, repeated by QA Financial and SC Media, not on an independent test.
Benefits
- Outcome identifiers
-
Not assessed
- Benefit
-
Spark, an AI fuzz-test agent, found a heap use-after-free in wolfSSL in late Oct 2024; fixed in PR 8139 and shipped in 5.7.6 on 31 December 2024.
- Category
-
Reduced Risk
- Status
-
Not assessed
- Beneficiary groups
-
Organizations.
- Beneficiaries
-
Not assessed
- Reach
-
Not assessed
- Distribution and access
-
Not assessed
- Duration
-
Not assessed
- Expected?
-
Yes
- Costs and harms
-
Not assessed
Measurement
- Studies
-
Not assessed
- Study design
-
Not assessed
- Measurement
-
Not assessed
- Setting and sample
-
Not assessed
- Measures
-
Not assessed
- Comparison
-
Not assessed
- Results
-
Not assessed
- Additional value from AI
-
Not assessed
- Limitations
-
Not assessed
- Denominators
-
Not assessed
- Materials for replication
-
Not assessed
Money
- Kind of value
-
Not assessed
- Amount
-
Not assessed
- Currency and prices
-
Not assessed
- Period and unit
-
Not assessed
- Realization
-
Not assessed
- Recipients and payers
-
Not assessed
- Gross or net
-
Not assessed
- Included costs
-
Not assessed
- Comparison
-
Not assessed
- Method
-
Not assessed
- Return and payback
-
Not assessed
People and places
- Participants
-
Developer:
Code Intelligence GmbH. Operator: Code Intelligence GmbH (beta test run by the vendor). - Jurisdictions
-
Benefit: Bonn,
Germany. Developer: Germany. Operator: Germany. - Ownership and control
-
Not assessed
- Dependencies
-
Not assessed
- Cross-border connections
-
Not assessed
- Geopolitical implications
-
Not assessed
Follow-up
- Conditions for replication
-
A human must confirm the finding. The vendor says the one manual step was assessing that the bug exists and is exploitable under specific conditions. The beneficiary must be an identifiable project with a public fix record. Without wolfSSL's PR and release notes the event would rest on vendor claims alone. The AI's share of the work is described only by the vendor. wolfSSL's records name the reporter, not the tool, so the autonomy claim cannot be replicated without the vendor's product.
- Replication attempts
-
Not assessed
- Later findings
-
31 December 2024. wolfSSL shipped the fix in release 5.7.6 on 31 December 2024, crediting the reporter in its release notes, and Code Intelligence launched Spark publicly in January 2025.
- Availability
-
Not assessed
- Institutional decision
-
Not assessed
- Grounds
-
Not assessed
- Action and result
-
Not assessed
- Success criterion
-
Not assessed
Evidence
- Source numbers
-
AIBD-0124-source-0001–0006
- Citations
-
Numbered references below.
- Language
-
Not assessed
- Source relationships
-
Beneficiary, Developer, Independent
- Original evidence
-
Not assessed
- Access and versions
-
Not assessed
- Supported findings
-
Not assessed
- Evidence links
-
Not assessed
- Evidence strength
-
Not assessed
- Missing evidence
-
Not assessed
Grades
- Assessed benefits
-
Organizations.
- Depth
-
Organizations: 2.
- Reasons
-
Organizations: wolfSSL received a reproducible report of a heap use-after-free in a private-key parsing path. It merged the fix within days (PR 8139, 1 November 2024) and shipped it in 5.7.6 on 31 December 2024. The maintainers listed it among bug fixes rather than in the release's Vulnerabilities section. No CVE for it appears on wolfSSL's vulnerabilities page. The vendor itself says the exploit conditions “don't seem easy to meet”, so the benefit is material but bounded.
- Observed or intended
-
Not assessed
- Rubric
-
Not assessed
- Assessor and date
-
Not assessed
- Alternative assessments
-
Not assessed
- Fill
-
Independently reported
Entry details
- Kind
-
Not assessed
- Related entries
-
Not assessed
- Field
-
Software security / open-source cryptography library testing. Open-source TLS and cryptography library for embedded and IoT systems.
- Purpose
-
Spark was built to find bugs and vulnerabilities autonomously by selecting functions to fuzz and generating and running fuzz tests. Finding this flaw was exactly that function, exercised in the vendor's own beta test.
- Dates
-
Date basis unassessed: 2024 (precision unassessed). Updated: 21 October 2026.
- Stage
-
Not assessed
- Version
-
SHA-256: 7ce94ae129ba…
References
- Other identifiers
-
oecd_aim: 2025-01-09-764d.
- Category mappings
-
Not assessed
- Brief
-
Not assessed
- Revisions
-
5 revisions. Latest: 21 October 2026.
Sources
-
News report Independent author
Willems, M. (2025). German startup to launch world's first AI test agent. QA Financial, 13 January 2025.
Brueggemann claimed his firm shared the bug with WolfSSL’s team, which went on to issue a warning and update in December of last year.
-
News report Independent author
French, L. (2025). How AI can revolutionize vulnerability research. SC Media, 3 February 2025.
Code Intelligence’s Spark autonomously discovering a heap-based user-after-free vulnerability in popular open-source wolfSSL library during its beta testing in October 2024.
-
Press release Developer
Samarin, P. (2025). How AI-generated fuzz test uncovered a vulnerability in wolfSSL. Code Intelligence blog, 3 January 2025; Wayback Machine capture of 9 January 2025 (the live domain did not resolve on 20 October 2026).
The vulnerability was identified in wolfSSL, an open-source cryptography library widely used in developing embedded devices and IoT systems, during the final week of October 2024.
-
Press release Developer
Code Intelligence (2025). Code Intelligence Launches Spark, Its AI Test Agent That Autonomously Uncovers Vulnerabilities Without Human Interaction. PR Newswire, Bonn, 9 January 2025.
The only human involvement was launching a single command to run the AI Test Agent; analyzing the code, generating a relevant test case, and running it was done autonomously.
-
Other Beneficiary
wolfSSL (2024). wolfSSL Release 5.7.6 (Dec 31, 2024), release notes, Bug Fixes. GitHub, wolfSSL/wolfssl, tag v5.7.6-stable, published 31 December 2024.
Fix for potential heap use after free with wolfSSL_PEM_read_bio_PrivateKey. Thanks to Peter for the issue reported. (PR 8139)
-
Other Beneficiary
src/pk.c: in pem_read_bio_key(), fix invalid read (ZD#18875).