ExploreRepair: Evidence-Specialized Agents for Vulnerability Repair under Information Constraints
Automated vulnerability repair must often operate with incomplete vulnerability information: developers may lack an accu
#cs.SE
共收录 457 条相关情报。
← 返回所有主题When Static Reachability Says No: Checking Joern-Based Negative Verdicts for Python Against Execution
A negative reachability verdict removes a finding from human review. We check such verdicts against execution. Our pipel
DeepDiff: Neuro-Dynamic Regression-Freedom Checking for Security Patch Validation
Automatically validating AI-generated security patches remains a significant challenge. Eliminating a reported crash and
CARI: Cross-Boundary Adversarial Runtime Injection in Coding-Agent Workflows
Coding agents increasingly develop, test, and integrate software whose components are owned by different developers, tea
How Deterministic SAST and AI Security Agents Divide the Work: Coverage, Harness Policy and Cost in Snyk VulnBench 2.0
We ask what AI coding agents and AI security harnesses find that deterministic static application security testing (SAST
Security Impact of Coding Agent's Memory Files
Coding agents automatically load project memory files such as CLAUDE.md at the start of every session and treat them as
Understanding Post-Quantum Cryptography Adoption: Practices, Challenges, and Evolution in Open-Source Software
Post-quantum cryptography (PQC) standards establish algorithms for quantum-safe systems, but empirical evidence about ho
ICALL-BENCH: Benchmarking LLM Interprocedural Reasoning in Binary Programs
Recent benchmarks show that LLMs achieve strong performance in both function-level binary understanding and end-to-end b
Structured Security Explanations for Learning-Based Vulnerability Detection
Software vulnerability detection remains difficult because existing approaches rely on predefined analysis rules, learn
When Skills Tell Agents Not to Ask: A Large-Scale Study of Oversight Directives in Agent Skills
Agent skills, reusable instruction packages centred on a SKILL.md file, extend AI agents on demand, and a single line in
CASEL: Consequence-Aware Selective Execution for Reliable Long-Horizon Tool-Using Agents
Tool-using language agents increasingly modify external systems, yet most runtime safeguards allocate scrutiny by generi
The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation
Web services increasingly expose backend interfaces that let users delegate tasks to AI agents, which invoke service ope
JANUS: Synthesizing Cross-Layer Defenses Against Web Deserialization Attacks
Unsafe deserialization turns untrusted data into attacker-controlled execution, and a single vulnerability can admit div
Then there is prompt injection, a malicious email, ...: The Wild Wide West of OpenClaw Agentic System Security
AI-powered personal assistant frameworks such as OpenClaw combine LLM reasoning, persistent memory, tool invocation, loc
NovaFabric: A Black-Box Recorder for AI Agents with Sealed, Replayable, Diffable and Auditable Runs
An AI agent run is no longer a function call. It is a cascade of prompts, model calls, tool invocations, file and networ
CyberDual: AI Attackers versus AI Code Reviewers in Real Software Maintenance
Open-source projects now let AI agents review incoming code, but the code under review may itself come from an AI attack
SymLift: Neural Semantic Lifting for Compile-Free Vulnerability Detection in Context-Incomplete Code Fragments
Missing project context can prevent build-dependent analyzers from constructing program relations required for vulnerabi
Repairing Broken Access Control in Web Applications with LLMs: An Empirical Benchmark Study
Broken access control (BAC) ranks among the most severe web-application vulnerability classes, yet its automated repair
The Policies of Programming Language Ecosystems: A "Qualitative" Analysis
Programming language ecosystems (PLEs), such as CRAN for R, have greatly accelerated software reuse. At the same time, t
Securing Agent-Generated Code with Its Own Development History
Pull requests written by coding agents can pass a project's test suite while omitting a guard or a validation step. To f