Exfault – AI-Powered Android App Pentesting

TL;DR

TL;DR: Exfault deploys AI agents inside cloud Android emulators to autonomously find and reproduce vulnerabilities in Android apps — no APK source required, supports authenticated testing flows.

Source and Accuracy Notes

⚠️ This section is MANDATORY. All links must be verified from actual source, not guessed.

• Project page: exfault.com ← verified Jul 2026
• License: proprietary (SaaS, no open-source license stated)
• HN launch thread: news.ycombinator.com/item?id=48719261 ← verified via Algolia API
• Source last checked: 2026-07-07

What Is Exfault?

Exfault is a web-based autonomous security testing platform purpose-built for Android applications. Where most AI-native pentesting tools focus on web targets, Exfault fills the gap for mobile: it runs AI agents inside real cloud Android emulators, combines static and dynamic analysis, and supports authenticated workflow testing — all without needing the app’s source code.

The platform launched on Hacker News in July 2026. Its pricing is straightforward: a free Demo tier covering one assessment, and a $119/month Professional tier for continuous testing.

Setup Workflow

Step 1: Enter a Package Name or Upload an APK

No app source required. Exfault accepts either an Android package name (for publicly available apps) or an APK/AAB binary. If you provide a package name, Exfault’s backend automatically acquires a compatible build.

Step 2: Configure Authenticated Testing (Optional)

For apps behind login, provide test credentials. The AI agent will automatically sign in and continue exploring the authenticated attack surface. Work on MFA and email-verification flows is in progress.

Step 3: Review the Report

Exfault produces reproducible security findings with full evidence, including the agent timeline. Findings are structured for direct use in bug bounty submissions or internal security reviews.

Technical Architecture

Exfault’s testing pipeline chains multiple security tools behind an AI agent orchestration layer:

Static analysis tools:

• adb — Android Debug Bridge for device interaction
• jadx — DEX to Java decompiler for reverse engineering
• apktool — APK拆包 and resource extraction
• hermes-dec — React Native Hermes bytecode decompiler

Dynamic analysis:

• frida — runtime instrumentation and hooking

Agent layer: AI agents control a cloud Android emulator, navigate app screens, validate vulnerabilities, and suppress false positives before including findings in the final report.

Deeper Analysis

Why Mobile Pentesting Was Behind

AI-native security tools have proliferated for web targets, but mobile lagged. The reasons are practical: Android emulators are heavy to run, mobile authentication flows are harder to automate, and reverse engineering mobile apps requires specialized tooling. Exfault abstracts this complexity behind a simple package-name-or-APK input and a structured report output.

Authenticated Testing Is the Hard Part

Passive APK scanning misses anything behind login. Exfault’s agent-based approach can actually exercise authenticated code paths — important for apps where the most sensitive functionality is gated. The limitation is complex MFA flows, which currently still require human-in-the-loop assistance.

Pricing Reality

At $119/month for the Professional tier, Exfault targets security teams rather than individual researchers. The free Demo tier lets you test one app without commitment — useful for evaluating the output quality before subscribing.

Practical Evaluation Checklist

• Supports package-name input (no APK upload needed for public apps)
• Static analysis via adb, jadx, apktool, hermes-dec
• Dynamic analysis via frida instrumentation
• Cloud emulator execution with AI agent control
• Authenticated testing with credential injection
• Reproducible vulnerability reports with evidence
• Free tier for one-off assessments
• $119/month Professional tier for continuous testing

Security Notes

• Test credentials are used only during the assessment window
• App binaries are processed in isolated cloud emulator environments
• Findings include full reproduction steps, not just scanner output

FAQ

Q: Does Exfault require the app source code? A: No. Exfault works with an APK/AAB binary or a package name for publicly available apps. It reverse-engineers the binary directly.

Q: What kinds of analysis does it perform? A: Both static analysis (jadx, apktool, adb, hermes-dec) and dynamic analysis (frida) inside a real cloud Android emulator controlled by AI agents.

Q: Does it support authenticated flows? A: Yes, for standard username/password flows. MFA and email-verification flows are on the roadmap.

Q: What is the output format? A: Structured security reports with reproducible findings, evidence截图, and agent timeline logs.

Q: Is Exfault open source? A: No — it is a proprietary SaaS platform. No source code is available.

Q: What Android versions are supported? A: The platform uses cloud Android emulators. Specific Android version support should be confirmed directly on exfault.com.

Conclusion

Exfault addresses a real gap in the AI security tooling landscape: mobile app pentesting. By combining static and dynamic analysis with AI agents running inside cloud Android emulators, it produces actionable vulnerability reports without requiring the target app’s source code. The authenticated testing support is the feature that makes it genuinely useful for security teams. The free Demo tier makes it easy to evaluate.

Web: exfault.com