Where Do the Tokens Go? Understanding and Reducing Costs in LLM Agents for Vulnerability Discovery
LLM agents can spend millions of tokens during vulnerability discovery without producing a working proof of concept (PoC
#cs.SE
共收录 457 条相关情报。
← 返回所有主题SoK: Are LLMs Reliable at Source Code Recovery? A Taxonomy and Empirical Evaluation
Effective source recovery is critical to security applications such as malware analysis, vulnerability assessment, and l
Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub
Agent skills are SKILL.md instructions and scripts that AI coding agents such as Claude Code and Codex run with the perm
When Flaws Cascade: Understanding Vulnerabilities and Exploitation Chains in JavaScript Engines
JavaScript engines are pivotal to modern web browsers, enabling the execution of dynamic and interactive web application
DITTO: A Context-aware Pickle-based Pre-Trained Model Scanner for Effective Security Audits
Pre-trained models (PTMs) are widely distributed as serialized binaries, but their reuse often exposes software supply c
Applying Security by Design at the Point of Execution: How Governed Security Requirements Affect the Security of AI-Generated Code
Security by design asks that security requirements are defined before code is written. Secure-code benchmarks typically
SoK: Failure Modes in Common Criteria Product Evaluation - A Taxonomy and Design-for-Evaluability Guidance
The Common Criteria (CC; ISO/IEC 15408) is the principal international framework for evaluating the security of IT produ
On the Reliability of LLM-Based Vulnerability Patching Benchmarks
Large language models (LLMs) have shown strong potential for automated vulnerability patching, but current benchmarks ca
CYBERFORT: A Compliance-Chain Platform Operationalising the Cyber Resilience Act for SMEs
The EU Cyber Resilience Act (CRA) turns product cybersecurity into a lifecycle compliance obligation for manufacturers,
Hierarchical Security Monitoring for Edge-IoT: A Formal Methods Approach
Cyber resiliency in edge-IoT deployments is fundamentally an economic problem: detection must keep critical processes op
MRCert: Towards Post-deployment Patch Robustness Certification for Adversarially Patched Samples via Type-specific Masking
In post-deployment time, inputs to deep learning models may or may not be adversarially patched. Patch robustness certif
Beyond FAIR: A Fitness Function Framework for Sustainable Research Software
Research software sustainability is often assessed through the FAIR principles: findability, accessibility, interoperabi
PyCache Trap: The Inspection-Execution Gap in Agent Skill Scanners
Agent skills combine instructions with executable resources, giving third-party packages access to an agent's runtime. E
How Fragile Is On-Device Language Model Safety? Localizing Safety-Critical Parameters for Sparse Fault Analysis
As small language models (SLMs) are increasingly deployed on resource-constrained and on-device platforms, including as
Learning from Failures: A Failure-Driven Prompt Refinement for LLM-Based Vulnerability Analysis
Large Language Models have emerged as promising tools for software vulnerability analysis, but their effectiveness depen
Newer and Bigger, but Safer? A Longitudinal Study of the Functionality-Security Gap in LLM-Generated Code
Large Language Models (LLMs) are widely used to generate code. Although their functional plausibility keeps improving, t
When Tools Lie: Reliability of Mathematical Agents Under Corrupted Tool Feedback
Mathematical problem solving often requires deterministic computational steps that agents delegate to tools and implicit
HarnessSecurity-Bench: Do Security Mechanisms Really Protect Coding Agent Harnesses?
Coding agent harnesses mediate tool use and authorize actions, yet their security mechanisms and runtime effects remain
CISB-Bench: An Auditable Source--IR Dataset of Compiler-Introduced Security Bugs
Compiler-introduced security bugs (CISBs) arise when an optimization, lowering, or instrumentation decision changes a se
CheckerBench: Can Long-Horizon Agents Synthesize Static-Analysis Checkers?
Static-analysis checker synthesis requires agents to interpret a defect specification, inspect a repository, implement a