Agent-driven fuzzing harness for expanding Chromium CSS parser coverage with LLM-generated test cases, ASan feedback, tmux workers, crash capture, and a lightweight dashboard.

This is a sanitized public version of a private security-testing workflow. It does not include server IPs, credentials, private logs, crash artifacts, or proprietary findings.

• Long-running autonomous testing loop with human-readable prompts.
• Codex / Claude-style agent orchestration for generating structured fuzz inputs.
• ASan crash detection and artifact capture.
• Parallel tmux worker management for high-volume test generation.
• Operational lessons around sandboxing, worker reliability, and prompt drift.

Prompt templates
      |
      v
Agent runner loop
      |
      v
Generated HTML/CSS inputs
      |
      v
Chromium css_parser_fuzzer (ASan build)
      |
      v
Crash detector -> crash artifacts -> dashboard

.
├── README.md
├── TASK.md
├── LESSONS.md
├── prompts/
│   ├── claude.txt
│   ├── codex.txt
│   ├── codex_claude.txt
│   ├── gen_seeds.txt
│   └── reseed.txt
└── scripts/
    ├── start.sh
    ├── run_worker.sh
    ├── run_fuzzer.sh
    ├── watchdog.sh
    ├── monitor.sh
    ├── reseed_cron.sh
    └── dashboard.py

Set these environment variables for your own lab:

export FUZZER_BIN=/path/to/css_parser_fuzzer
export CRASH_DIR=$PWD/crashes
export LOG_DIR=$PWD/logs
export CORPUS_DIR=$PWD/corpus/css_parser_fuzzer
export MACHINE_USER=<user>
export MACHINE_IP=<host>
export SSH_KEY_PATH=~/.ssh/id_ed25519

The scripts assume you already have a Chromium ASan fuzz target built. They intentionally do not ship Chromium binaries or crash artifacts.

Local worker:

mkdir -p "$CRASH_DIR" "$LOG_DIR"
bash scripts/run_worker.sh 1

Remote tmux workers:

bash scripts/start.sh 3

Dashboard:

python3 scripts/dashboard.py

This project is for authorized security testing and test coverage improvement. Do not run it against systems you do not own or have permission to test.

The public repo excludes:

• real server IPs and SSH keys;
• private crash artifacts;
• private logs;
• credentials or model tokens;
• unverified vulnerability claims.

This is a harness and operating playbook, not a claim of accepted Chromium vulnerabilities. Its value is in showing how to structure long-running agentic fuzzing work so failures, prompts, workers, and crash artifacts can be inspected.