9 papers
No, Your Tools Are Not Enough: It's Time to Bring Agents to the Hunt
Ati Priya Bajaj, Xiang Mei, Tiffany Bao +3
Modern software systems are large and complex, demanding scalable and autonomous techniques for vulnerability discovery. Existing approaches still depend on human expertise for dom…
No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers
Zehua Zhang, Jie Hu, Pratham Hegde +14
Conventional vulnerability analysis relies on either system access or dynamic interaction, all of which may be unavailable to third-party analysts auditing closed-source, remotely…
ARVO: Atlas of Reproducible Vulnerabilities for Open-Source Software
Xiang Mei, Jordi Del Castillo, Pulkit Singh Singaria +8
Achieving reproducibility, quantity, and diversity in vulnerability datasets has long been viewed as an inherent three-way trade-off, where improving one dimension often comes at t…
Root-Cause-Driven Automated Vulnerability Repair
Hulin Wang, Zion Leonahenahe Basque, Jie Hu +13
Recent LLM-based systems have made automated vulnerability repair increasingly practical, but two challenges remain. First, without strong signals about where a bug originates, rep…
Do Hackers Dream of Electric Teachers?: A Large-Scale, In-Situ Measurement of Cybersecurity Student Behaviors and Educational Performance with AI Tutors
Michael Tompkins, Nihaarika Agarwal, Ananta Soneji +8
To meet the ever-increasing demands of the cybersecurity workforce, AI tutors have been proposed for personalized, scalable education. But, while AI tutors have shown promise in in…
BuildBench: Benchmarking LLM Agents on Compiling Real-World Open-Source Software
Zehua Zhang, Ati Priya Bajaj, Divij Handa +14
Automatically compiling open-source software (OSS) projects is a vital, labor-intensive, and complex task, which makes it a good challenge for LLM Agents. Existing methods rely on…
ARVO: Atlas of Reproducible Vulnerabilities for Open-Source Software
Xiang Mei, Jordi Del Castillo, Pulkit Singh Singaria +8
Achieving reproducibility, quantity, and diversity in vulnerability datasets has long been viewed as an inherent three-way trade-off, where improving one dimension often comes at t…
Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation
Ziyi Guo, Dang K Le, Zhenpeng Lin +6
Recently, a novel method known as Page Spray emerges, focusing on page-level exploitation for kernel vulnerabilities. Despite the advantages it offers in terms of exploitability, s…
Using Deception in Markov Game to Understand Adversarial Behaviors through a Capture-The-Flag Environment
Siddhant Bhambri, Purv Chauhan, Frederico Araujo +2
Identifying the actual adversarial threat against a system vulnerability has been a long-standing challenge for cybersecurity research. To determine an optimal strategy for the def…