55 citations · 110 across the 23 of their papers we have counts for
15 papers · 1 filter
Efficient and Sound Probabilistic Verification for AI Agents
Alaia Solko-Breslin, Pramod Kaushik Mudrakarta, Mihai Christodorescu +2
Securing AI agents that operate in complex digital environments has become a critical need, and runtime monitoring approaches that formulate and enforce policies expressed in a for…
Agent Security is a Systems Problem
Mihai Christodorescu, Earlence Fernandes, Ashish Hooda +11
We take the position that agent security must be approached as a systems problem: the AI model powering the agent must be treated as an untrusted component, and security invariants…
Taint-Style Vulnerability Detection and Confirmation for Node.js Packages Using LLM Agent Reasoning
Ronghao Ni, Mihai Christodorescu, Limin Jia
The rapidly evolving Nodejs ecosystem currently includes millions of packages and is a critical part of modern software supply chains, making vulnerability detection of Nodej…
Uncovering Relationships between Android Developers, User Privacy, and Developer Willingness to Reduce Fingerprinting Risks
Alex Berke, Güliz Seray Tuncay, Michael Specter +1
The major mobile platforms, Android and iOS, have introduced changes that restrict user tracking to improve user privacy, yet apps continue to covertly track users via device finge…
Systems Security Foundations for Agentic Computing
Mihai Christodorescu, Earlence Fernandes, Ashish Hooda +11
In recent years, agentic artificial intelligence (AI) systems are becoming increasingly widespread. These systems allow agents to use various tools, such as web browsers, compilers…
When "Correct" Is Not Safe: Can We Trust Functionally Correct Patches Generated by Code Agents?
Yibo Peng, James Song, Lei Li +6
Code agents are increasingly trusted to autonomously fix bugs on platforms such as GitHub, yet their security evaluation focuses almost exclusively on functional correctness. In th…
Fingerprinting SDKs for Mobile Apps and Where to Find Them: Understanding the Market for Device Fingerprinting
Michael A. Specter, Mihai Christodorescu, Abbie Farr +7
This paper presents a large-scale analysis of fingerprinting-like behavior in the mobile application ecosystem. We take a market-based approach, focusing on third-party tracking as…
Formal Analysis of the API Proxy Problem
Somesh Jha, Mihai Christodorescu, Anh Pham
Implementing a security mechanism on top of APIs requires clear understanding of the semantics of each API, to ensure that security entitlements are enforced consistently and compl…
Privacy-Preserving Application-to-Application Authentication Using Dynamic Runtime Behaviors
Mihai Christodorescu, Maliheh Shirvanian, Shams Zawoad
Application authentication is typically performed using some form of secret credentials such as cryptographic keys, passwords, or API keys. Since clients are responsible for secure…
Universal Payment Channels: An Interoperability Platform for Digital Currencies
Mihai Christodorescu, Erin English, Wanyun Catherine Gu +7
With the innovation of distributed ledger technology (DLT), often known as blockchain technology, there has been significant growth of digital tokens in the form of cryptocurrencie…
Towards a Two-Tier Hierarchical Infrastructure: An Offline Payment System for Central Bank Digital Currencies
Mihai Christodorescu, Wanyun Catherine Gu, Ranjit Kumaresan +8
Digital payments traditionally rely on online communications with several intermediaries such as banks, payment networks, and payment processors in order to authorize and process p…
Privacy-Preserving Payment Splitting
Saba Eskandarian, Mihai Christodorescu, Payman Mohassel
Widely used payment splitting apps allow members of a group to keep track of debts between members by sending charges for expenses paid by one member on behalf of others. While off…
The House That Knows You: User Authentication Based on IoT Data
Talha Ongun, Oliver Spohngellert, Alina Oprea +3
Home-based Internet of Things (IoT) devices have gained in popularity and many households have become 'smart' by using devices such as smart sensors, locks, and voice-based assista…
REMOTEGATE: Incentive-Compatible Remote Configuration of Security Gateways
Abhinav Aggarwal, Mahdi Zamani, Mihai Christodorescu
Imagine that a malicious hacker is trying to attack a server over the Internet and the server wants to block the attack packets as close to their point of origin as possible. Howev…
Learning Execution Contexts from System Call Distributions for Intrusion Detection in Embedded Systems
Man-Ki Yoon, Sibin Mohan, Jaesik Choi +2
Existing techniques used for intrusion detection do not fully utilize the intrinsic properties of embedded systems. In this paper, we propose a lightweight method for detecting ano…