27 citations · 70 across the 44 of their papers we have counts for
16 papers · 1 filter
MalTotal: Cost-Effective and Language-Agnostic Malicious Code Poisoning Detection for Millions of Repositories
Jian Zhao, Shenao Wang, Qingyang Wu +3
The widespread adoption of open source software (OSS) has introduced significant security risks, with malicious code poisoning attacks increasingly targeting public package registr…
Demystifying and Detecting Agentic Workflow Injection Vulnerabilities in GitHub Actions
Shenao Wang, Xinyi Hou, Zhao Liu +5
GitHub Actions is increasingly used to deploy LLM-based agents for repository-centric tasks such as issue triage, pull-request review, code modification, and release assistance. Th…
MalSkills: Detecting Malicious Skills in the Agentic Supply Chain via Neuro-symbolic Reasoning
Shenao Wang, Junjie He, Yanjie Zhao +3
Skills are increasingly used to extend LLM agents by packaging prompts, code, and configurations into reusable modules. As public registries and marketplaces expand, they form an e…
Evaluating and Enhancing the Vulnerability Reasoning Capabilities of Large Language Models
Li Lu, Yanjie Zhao, Hongzhou Rao +2
Large Language Models (LLMs) have demonstrated remarkable proficiency in vulnerability detection. However, a critical reliability gap persists: models frequently yield correct dete…
SMCP: Secure Model Context Protocol
Xinyi Hou, Shenao Wang, Yifan Zhang +4
Agentic AI systems built around large language models (LLMs) are moving away from closed, single-model frameworks and toward open ecosystems that connect a variety of agents, exter…
Demystifying Cookie Sharing Risks in WebView-based Mobile App-in-app Ecosystems
Miao Zhang, Shenao Wang, Guilin Zheng +2
Mini-programs, an emerging mobile application paradigm within super-apps, offer a seamless and installation-free experience. However, the adoption of the web-view component has dis…
From Assistants to Adversaries: Exploring the Security Risks of Mobile LLM Agents
Liangxuan Wu, Chao Wang, Tianming Liu +2
The growing adoption of large language models (LLMs) has led to a new paradigm in mobile computing--LLM-powered mobile AI agents--capable of decomposing and automating complex task…
Directed Greybox Fuzzing via Large Language Model
Hanxiang Xu, Yanjie Zhao, Haoyu Wang
Directed greybox fuzzing (DGF) focuses on efficiently reaching specific program locations or triggering particular behaviors, making it essential for tasks like vulnerability detec…
Unveiling the Landscape of LLM Deployment in the Wild: An Empirical Study
Xinyi Hou, Jiahao Han, Yanjie Zhao +1
Large language models (LLMs) are increasingly deployed through open-source and commercial frameworks, enabling individuals and organizations to self-host advanced LLM capabilities.…
Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions
Xinyi Hou, Yanjie Zhao, Shenao Wang +1
The Model Context Protocol (MCP) is an emerging open standard that defines a unified, bi-directional communication and dynamic discovery protocol between AI models and external too…
Demystifying LLM Supply Chain Vulnerabilities in the Wild: Distribution, Root Cause, and Real-World Impact
Shenao Wang, Yanjie Zhao, Zhao Liu +2
LLMs are rapidly transitioning from research prototypes to core components in production systems across industries such as finance and healthcare. These deployments rely on a growi…
Models Are Codes: Towards Measuring Malicious Code Poisoning Attacks on Pre-trained Model Hubs
Jian Zhao, Shenao Wang, Yanjie Zhao +6
The proliferation of pre-trained models (PTMs) and datasets has led to the emergence of centralized model hubs like Hugging Face, which facilitate collaborative development and reu…
Towards Robust Detection of Open Source Software Supply Chain Poisoning Attacks in Industry Environments
Xinyi Zheng, Chen Wei, Shenao Wang +5
The exponential growth of open-source package ecosystems, particularly NPM and PyPI, has led to an alarming increase in software supply chain poisoning attacks. Existing static ana…
On the (In)Security of LLM App Stores
Xinyi Hou, Yanjie Zhao, Haoyu Wang
LLM app stores have seen rapid growth, leading to the proliferation of numerous custom LLM apps. However, this expansion raises security concerns. In this study, we propose a three…
Seeing is (Not) Believing: Practical Phishing Attacks Targeting Social Media Sharing Cards
Wangchenlu Huang, Shenao Wang, Yanjie Zhao +2
In the digital era, Online Social Networks (OSNs) play a crucial role in information dissemination, with sharing cards for link previews emerging as a key feature. These cards offe…
Large Language Models for Cyber Security: A Systematic Literature Review
Hanxiang Xu, Shenao Wang, Ningke Li +6
The rapid advancement of Large Language Models (LLMs) has opened up new opportunities for leveraging artificial intelligence in a variety of application domains, including cybersec…