AI
OSS Sensor: Apple’s Open Source as a Triage Input
OSS Sensor is a tool Gallucci published to turn Apple’s open source into a prioritized research queue. It ingests OSS diffs, basic binary features, and log templates, then applies rule-based scoring to rank what to look at next. No integrated LLM does the vulnerability verification. That part is intentional. The tool is a triage and hypothesis aid, not an automated discovery engine. Two versions exist: one without AI, one with. Gallucci recommends starting with the non-AI version, which is easier to adapt if you plan to wire in your own workflow.
The Apple Surface Area Problem and Why AI Agents Help
Apple has over 400 public repos, but the releases are incomplete and change too fast for manual review. Core Foundation, CFNetwork, and iOS-specific drivers are missing or partial. Headers reference files that don’t exist. Gallucci’s fix is to stop treating the open source as a complete picture and start treating it as a map.
“You might not have the full territory, but these landmarks are real.” — Olivia Gallucci
AI agents handle the bookkeeping — tracking diffs, correlating symbols, flagging security-relevant changes — so Gallucci can spend time on the parts that still require human judgment: privilege boundaries and exploitability.
Binary Diffing and Reverse Engineering with Agent Tooling
Binary diffing works backward from the patch to the bug. In 2016, an OS X researcher used Diaphora to diff syslogd between 10.11.2 and 10.11.3, found exactly one changed function, and watched value+4 become value×4+4 — an allocation math fix that read as a heap overflow mitigation, confirmed by a nearby “lockdown session realloc failed” string. That diff took minutes. The same logic holds for large codebases: patches fix one file, but identical code in adjacent files stays vulnerable. An agent running this workflow continuously — ingesting every Apple release, scoring changes by pattern (allocation math, bounds checks, entitlement gating, IOKit method tables), and emitting a ranked triage queue — compresses the window between “Apple shipped something” and “we know what shifted.”
Unified Logging as an Attack Surface Pivot
macOS unified logging gives you subsystem and category labels that map to components, stable message strings to hunt in binaries, and error paths that expose parsing assumptions, type expectations, and IPC contracts. Gallucci treats these logs as a pivot into attack surface, not a definitive source. The noise is high and the volume is large, but the ROI for target selection and harness design is real. In the Agent log-to-binary pipeline walkthrough (11:32), an agent takes a log line, locates that string in a binary via strings, retrieves adjacent OSS code for the callers, and outputs a structured summary of inputs, trust boundaries, and parsing behavior, ready to feed directly into fuzz planning or detection engineering.
AI-Assisted Fuzz Planning: From Hypothesis to Harness
The fuzz planner agent doesn’t produce an exploit. It produces a plan. Starting from the trust-boundary entry points identified in the log and diff analysis, it outputs a minimal test harness: invocation path, entitlement requirements, and expected input shapes so the target is reachable and reproducible. It then recommends a seed strategy, extracting dictionaries from strings, mining parameters from logs, and defines success metrics like crash bucketing and unique stack traces. Gallucci keeps it scoped to bug class prediction and harness design. As she puts it: “I don’t treat the model as God, I treat it as a junior junior engineer that can read fast, follow procedures, and generate structured hypotheses that we can validate with reversing, tracing, and fuzzing.”
Limits of the Workflow and Human-in-the-Loop Requirements
The agents handle bug class prediction and harness design. Humans own exploitability. Gallucci keeps the pipeline constrained by design, partly because large models resist full offensive reasoning, and partly because token cost climbs fast when you feed entire OS subsystems through a context window. Incomplete OSS releases, binary obfuscation, and licensing restrictions mean every conclusion needs provenance tracking so you can explain how you got there. “The model’s not God, it’s a tool using junior analyst.” That framing is the whole point.
Q&A
What would have to change for you to give the AI bigger tasks and have it take on more? Token costs are the hard ceiling — Gallucci tried to scale the workflow down for on-the-go research and found costs hit a thousand dollars fast when feeding entire OS subsystems, so the honest answer was ‘give me lots of money.’ ▶ 19:30
Notable Quotes
I don’t treat the model as God, I treat it as a junior junior engineer that can read fast, follow procedures, and generate structured hypotheses that we can validate with reversing, tracing, and fuzzing. Olivia Gallucci · ▶ 10:11
You might not have the full territory, but these landmarks are real. Olivia Gallucci · ▶ 5:00
The model’s not God, it’s a tool using junior analyst. Olivia Gallucci · ▶ 16:17
dude, you hit a grand quickly when you’re putting in entire subsystems of operating systems. Olivia Gallucci · ▶ 20:30
Key Takeaways
- Treat Apple’s partial open source as a sensor stream: diffs signal what changed, binaries reflect what shipped, logs reveal which components handled input.
- Constrain AI agents to deterministic tool calls — strings, otool, class-dump — and bounded outputs; humans own exploitability and trust-boundary reasoning.
- Binary diffing after a patch is a reliable vulnerability-reversal technique; look for allocation math changes and nearby error strings as exploitation hints.