5 papers
Evaluating Retrieval-Augmented Generation for Explainable Malware Analysis
Jayson Ng, Amin Milani Fard
Large Language Models (LLMs) are increasingly being used as security engineering tools to summarize and explain malware behavior to analysts. A common assumption is that Retrieval-…
Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning
Charoes Huang, Xin Huang, Ngoc Phu Tran +1
The Model Context Protocol (MCP) has rapidly emerged as a universal standard for connecting AI assistants to external tools and data sources. While MCP simplifies integration betwe…
Are AI-assisted Development Tools Immune to Prompt Injection?
Charoes Huang, Xin Huang, Amin Milani Fard
Prompt injection is listed as the number-one vulnerability class in the OWASP Top 10 for LLM Applications that can subvert LLM guardrails, disclose sensitive data, and trigger unau…
Auditing MCP Servers for Over-Privileged Tool Capabilities
Charoes Huang, Xin Huang, Amin Milani Fard
The Model Context Protocol (MCP) has emerged as a standard for connecting Large Language Models (LLMs) to external tools and data. However, MCP servers often expose privileged capa…
Characterizing JavaScript Security Code Smells
Vikas Kambhampati, Nehaz Hussain Mohammed, Amin Milani Fard
JavaScript has been consistently among the most popular programming languages in the past decade. However, its dynamic, weakly-typed, and asynchronous nature can make it challengin…