13 citations · 30 across the 14 of their papers we have counts for
18 papers
No, Your Tools Are Not Enough: It's Time to Bring Agents to the Hunt
Ati Priya Bajaj, Xiang Mei, Tiffany Bao +3
Modern software systems are large and complex, demanding scalable and autonomous techniques for vulnerability discovery. Existing approaches still depend on human expertise for dom…
No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers
Zehua Zhang, Jie Hu, Pratham Hegde +14
Conventional vulnerability analysis relies on either system access or dynamic interaction, all of which may be unavailable to third-party analysts auditing closed-source, remotely…
ARVO: Atlas of Reproducible Vulnerabilities for Open-Source Software
Xiang Mei, Jordi Del Castillo, Pulkit Singh Singaria +8
Achieving reproducibility, quantity, and diversity in vulnerability datasets has long been viewed as an inherent three-way trade-off, where improving one dimension often comes at t…
ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?
Zhun Wang, Nico Schiller, Hongwei Li +13
AI agents are rapidly gaining capabilities that could significantly reshape cybersecurity, making rigorous evaluation urgent. A critical capability is exploitation: turning a vulne…
Root-Cause-Driven Automated Vulnerability Repair
Hulin Wang, Zion Leonahenahe Basque, Jie Hu +13
Recent LLM-based systems have made automated vulnerability repair increasingly practical, but two challenges remain. First, without strong signals about where a bug originates, rep…
Pushan: Trace-Free Deobfuscation of Virtualization-Obfuscated Binaries
Ashwin Sudhir, Zion Leonahenahe Basque, Wil Gibbs +9
In the ever-evolving battle against malware, binary obfuscation techniques are a formidable barrier to effective analysis by both human security analysts and automated systems. In…
Do Hackers Dream of Electric Teachers?: A Large-Scale, In-Situ Measurement of Cybersecurity Student Behaviors and Educational Performance with AI Tutors
Michael Tompkins, Nihaarika Agarwal, Ananta Soneji +8
To meet the ever-increasing demands of the cybersecurity workforce, AI tutors have been proposed for personalized, scalable education. But, while AI tutors have shown promise in in…
CTF Archive: Capture, Curate, Learn Forever
Pratham Gupta, Aditya Gabani, Connor Nelson +1
Capture the Flag (CTF) competitions represent a powerful experiential learning approach within cybersecurity education, blending diverse concepts into interactive challenges. Howev…
BuildBench: Benchmarking LLM Agents on Compiling Real-World Open-Source Software
Zehua Zhang, Ati Priya Bajaj, Divij Handa +14
Automatically compiling open-source software (OSS) projects is a vital, labor-intensive, and complex task, which makes it a good challenge for LLM Agents. Existing methods rely on…
Investigating the Security & Privacy Risks from Unsanctioned Technology Use by Educators
Easton Kelso, Ananta Soneji, Syed Zami-Ul-Haque Navid +3
Educational technologies are revolutionizing how educational institutions operate. Consequently, it makes them a lucrative target for breach and abuse as they often serve as centra…
ARVO: Atlas of Reproducible Vulnerabilities for Open-Source Software
Xiang Mei, Jordi Del Castillo, Pulkit Singh Singaria +8
Achieving reproducibility, quantity, and diversity in vulnerability datasets has long been viewed as an inherent three-way trade-off, where improving one dimension often comes at t…
Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation
Ziyi Guo, Dang K Le, Zhenpeng Lin +6
Recently, a novel method known as Page Spray emerges, focusing on page-level exploitation for kernel vulnerabilities. Despite the advantages it offers in terms of exploitability, s…
Trust, Because You Can't Verify:Privacy and Security Hurdles in Education Technology Acquisition Practices
Easton Kelso, Ananta Soneji, Sazzadur Rahaman +2
The education technology (EdTech) landscape is expanding rapidly in higher education institutes (HEIs). This growth brings enormous complexity. Protecting the extensive data collec…
The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning
Nathaniel Li, Alexander Pan, Anjali Gopal +54
The White House Executive Order on Artificial Intelligence highlights the risks of large language models (LLMs) empowering malicious actors in developing biological, cyber, and che…
Context-Auditor: Context-sensitive Content Injection Mitigation
Faezeh Kalantari, Mehrnoosh Zaeifi, Tiffany Bao +3
Cross-site scripting (XSS) is the most common vulnerability class in web applications over the last decade. Much research attention has focused on building exploit mitigation defen…
Scam Pandemic: How Attackers Exploit Public Fear through Phishing
Marzieh Bitaab, Haehyun Cho, Adam Oest +9
As the COVID-19 pandemic started triggering widespread lockdowns across the globe, cybercriminals did not hesitate to take advantage of users' increased usage of the Internet and t…
BootKeeper: Validating Software Integrity Properties on Boot Firmware Images
Ronny Chevalier, Stefano Cristalli, Christophe Hauser +6
Boot firmware, like UEFI-compliant firmware, has been the target of numerous attacks, giving the attacker control over the entire system while being undetected. The measured boot m…
Rise of the HaCRS: Augmenting Autonomous Cyber Reasoning Systems with Human Assistance
Yan Shoshitaishvili, Michael Weissbacher, Lukas Dresel +4
As the size and complexity of software systems increase, the number and sophistication of software security flaws increase as well. The analysis of these flaws began as a manual ap…