AI in the Loop: Lessons from Fuzzing, Evals, and GitHub Policies

Fuzzing with an agent. Fuzzing is a testing method: the program receives a large stream of malformed inputs, and the system records every crash.

To route the data to the required function, an engineer writes a harness.

Coverage shows what share of the code received input data at all.

An author from GitHub Security Lab explains why continuous fuzzing guarantees nothing: an engineer must monitor coverage, write harnesses for code the fuzzer did not reach, and analyze discovered crashes. Taskflow Agent handles part of this routine, while a human still makes the decision. Evaluating an LLM before production.

In the second one piece GitHub lists where a model with strong benchmark results breaks down. In production, users submit ambiguous requests, labels contradict one another, context is lost or truncated, and real data is distributed differently from the test set.

If the administrator selects nothing, users receive features according to the default policy. Chat as an interface.

Author columns notes that AI tools have been used at scale for three years, yet the main interface to LLMs remains a text box.

After three months, operations staff open the tool once a week, while the metric that motivated the project remains unchanged.

The model is usually not the issue in such cases.

The team did not build a test set from real requests, assign someone to analyze errors, or provide employees with rules and training for the new features.

This follows the TTU (time to use) principle: a tool's value is measured by how quickly it delivers a useful result in real work.

Demo appeal is not part of this metric.

### Testing with your own data The test set uses real requests from your system, including messy ones: incomplete item cards, conflicting reference data, and truncated documents.

Each model response is compared with a benchmark approved by a business representative.

After changing the model or prompt, the set is run again, like regression tests after a release. ### A human for exceptions Fuzzing provides a practical framework.

The agent handles the workload: coverage, initial analysis, and harness drafts.

A person reviews the cases the agent flagged as uncertain.

The expert spends fewer hours and remains accountable for the outcome. ### Controlled enablement

Copilot's 28-day window policy can serve as a model for internal AI systems.

The administrator first decides which features each employee group receives, and only then enables them.

Requests to models pass through a single point where they are logged and controlled. ### An interface for the task

Chatting with a bot would slow the process down for each of these 40,000 items.