Your Electron App is Already Exploitable: AI-Guided Discovery with Real-Time Harnessing

[ Abstract ]

This talk presents an AI-driven system for discovering and exploiting vulnerabilities in ElectronJS applications. By combining source–sink analysis with real-time harness generation, the approach reduces false positives and enables reliable exploit construction. Integrated into CI/CD, it scans every merge request, generates Semgrep rules from validated findings to identify similar patterns across the entire repository, and feeds results into an ELK-backed feedback loop that drives automated rule generation and runtime protections via a hardened ElectronJS security SDK.