4 papers
The History Is the Detector: Executing CVE Patch History, End-to-End
Qiushi Wu, Kevin Eykholt, Youngja Park +4
Public vulnerability databases collect rich information about known software flaws, including their weakness types, affected components, and related patches. Fixing commits provide…
Lessons from Penetration Tests on Large-Scale Agent Systems
Kevin Eykholt, Dhilung Kirat, Xiaokui Shu +3
As AI systems gain increasing autonomy and execution capability, the number of discovered security vulnerabilities continues to rise. However, many of these vulnerabilities are not…
Understanding Human-AI Collaboration in Cybersecurity Competitions
Tingxuan Tang, Nicolas Janis, Kalyn Asher Montague +6
Capture-the-Flag (CTF) competitions are increasingly becoming a testbed for evaluating AI capabilities at solving security tasks, due to the controlled environments and objective s…
One Bug, Hundreds Behind: LLMs for Large-Scale Bug Discovery
Qiushi Wu, Yue Xiao, Dhilung Kirat +3
Fixing bugs in large programs is a challenging task that demands substantial time and effort. Once a bug is found, it is reported to the project maintainers, who work with the repo…