In briefRoCoMark: A robust code watermarking method resisting LLM-based functionality-preserving rewriting attacks
SummaryThis paper addresses the problem that watermarks in generated code are often lost when large language models rewrite it while keeping its function. It proposes RoCoMark, a code watermarking framework in which the embedder and an LLM rewriter play a multi-round minimax game, with an adaptive attack-evolution mechanism based on Reflexion and memory pools. On four benchmarks against attacks generated by five LLMs, it reports an average detection AUROC of 74.2%, a Rewrite BitACC of 75.3%, and a functionality pass rate above 99.7%.
In briefSelf-healing system design inspired by the immune system for autonomous cyber resilience
SummaryThis paper explores how autonomous cyber resilience methods inspired by the human immune system can be combined with resilience mechanisms in naval and aeronautical maneuvering systems. Using TNO's OpPic application, it shows how TNO's Self-Healing for Cyber Security software can provide mission- and threat-adaptive resilience. Based on this, the authors derive six guidelines for designing autonomous cyber-resilient systems.
In briefBreaking Slide Puzzle CAPTCHAs with GAN-Generated Trajectories
SummaryThis paper systematically analyzes the defense strategies of six popular slide puzzle CAPTCHAs: Capy, Dingxiang, Geetest, Kyger, Shumei and Tencent. For each, the authors build a notch detection dataset and a slide trajectory dataset, use YOLOv11 to locate notches, and train generative adversarial networks to generate attack trajectories by learning human slide characteristics. The method reportedly succeeds over 90% of the time against all six CAPTCHAs in about 5 seconds, and the paper proposes ways to strengthen these CAPTCHAs.
In briefAI agents identify who owns cloud resources
SummarySecurity tools flag issues across cloud environments, but someone must still be found to fix each one, and recorded ownership is often outdated or missing. The paper proposes a reference architecture in which agents derive ownership from work records, code history, audit logs and identity directories, with confidence computed by rules. On 100 resources of 50 AWS resource types in one organization, it reached 92.1% weighted recall and 86.6% weighted precision, well above an unprimed general-purpose agent.
In briefSkillCODER: Auditing and Tracing Copyright Infringement in LLM Agent Skills
SummaryThis paper presents SkillCODER, a method for auditing copyright and identifying the buyer of LLM agent skills in a black-box, content-only setting. It embeds instructions that activate only under verification queries and encodes buyer-specific fingerprints using controlled-vocabulary error-correcting codes. Across three domains, six models, and three agent frameworks, it reports 99.2% owner verification and 99.3% buyer Top-1 attribution accuracy while preserving task fidelity. The signals remain detectable under paraphrase, compression, and several adaptive attacks.
In briefAuditing Agent Tool Calls with Intent Graphs and Reasoning Escalation
SummaryLLM agents that call tools can be steered by instructions hidden in tool outputs into actions the user never requested. The paper proposes a runtime audit that builds an executable intent graph from the user's objective and tool catalog with one LLM call per task, then checks each tool call with a deterministic, LLM-free loop (median 5.7 microseconds per call). Flagged calls are escalated to a reasoning guardian that sees the objective, plan, and call history but not tool outputs, and can verify facts with a restricted Python-expression tool. The authors note that a current agent showed no baseline attack success, so end-to-end validation remains open.
In briefErosionBench: A Benchmark Testing Alignment Decay in Enterprise Multi-Agent AI Systems
SummaryThis paper introduces ErosionBench, a benchmark for testing how multi-agent language model systems in enterprises can drift toward unsafe actions when benign requests propagate through shared state, long documents, and trusted peer messages. It contains 1,728 scenarios with matched benign controls plus 198 image-based attacks, and judges the realized tool call against authorized intent and provenance rather than output text. The authors also propose a calibrated Meta-Auditor as a reference defense, which reports 98.5% recall at a 2.9% false-positive rate on a held-out split.
Riya Bharathwaj, Akshara Prabhakar, Roshan Ram et al.
In briefChatter Attack: A resource-draining attack that makes LLMs produce excessively long outputs
SummaryThe paper introduces Chatter Attack, a type of resource consumption attack on large language models that optimizes adversarial prompts to induce short self-doubt phrases, sustaining long responses without an exploding search space. It maintains this state during generation using inference attention loss and global entropy loss. For black-box settings, the authors propose Bayesian Prompt Optimization (BPO), and experiments report maximum response length increases of up to 31.5 times.
In briefCan probes trained on benign data detect tool errors under attack?
SummaryThis paper asks whether hidden-state probes trained only on benign tool-use trajectories can still detect incorrect tool actions under adversarial conditions such as prompt injection, system override, and tool poisoning. The authors test three models on four AgentDojo suites and compare the probes against three scalar uncertainty metrics. They conclude that benign-trained hidden-state probes should not be assumed to reliably detect tool-action errors under adversarial conditions.
In briefTracing MCP Security Vulnerabilities: Building a Curated Dataset of Flaws in the Model Context Protocol
SummaryThis paper builds a curated dataset of 24 validated vulnerabilities in the Model Context Protocol (MCP), which connects large language models to external data sources and tools, using CVE disclosures. Of these, 87.5% are rated Critical or High severity, and injection and path traversal account for 66.7% of cases. The authors also identify recurring issues such as weak input validation and inadequate access control, and release the dataset and tooling for future research.
In briefBeyond AUROC: Deployment-Aware Evaluation of Jailbreak Detectors
SummaryThis paper studies detectors that use a model's internal signals to flag jailbreak prompts aimed at LLMs. It finds that thresholds calibrated on curated benign prompts often fail to hold their false-positive rate on real-user traffic. Recalibration improves false-positive control but exposes large coverage gaps across attack families. The authors recommend evaluating realized false-positive rates on deployment-like traffic and per-family true-positive rates at low false-positive points, with AUROC as a secondary metric.
Mohammad Tehabsim, Basil Al-Housani, Nour Alhussien et al.
In briefPQC-Corpus: A Linked Development History Dataset for Post-Quantum Cryptography
SummaryThis paper presents PQC-Corpus, a dataset linking issues, pull requests, commits, patches, comments, and reviews from 179 public GitHub repositories, including cryptographic libraries and general-purpose projects. It provides full and filtered views along with a patch-free view and traversal scripts. The dataset and collector are publicly released for studying post-quantum cryptography code changes.
Souhardya Saha Dip, Moshood A. Fakorede, Umar Farooq
In briefInterpretable Attack Detection for Smart Grids: Testing Fusion, Robustness, and Observability Limits Across Multiple Testbeds
SummaryThis paper evaluates an interpretable, time-windowed Random Forest for detecting cyber-physical attacks in smart grids, using multiple testbeds and adopting the more pessimistic result when evaluation protocols disagree. Under rolling-origin temporal evaluation, macro-F1 falls from 0.96 under shuffled cross-validation to 0.88. The study also reports robustness limits under feature-space attacks, weak detection of semantic value manipulation on IEC-104 traffic, and a comparison showing a physics-manifold test sustains detection against slow ramps where a temporal forecasting test does not on IEEE 118-Bus.
Muhammad Ridwanul Hoquea, Sarah Sharif, Reza Saeed Kandezy et al.
In briefTesting AI-Found Cloud Threats on Live Systems: A Multi-Model, Multi-Cloud Study
SummaryThe study presents a three-phase method of multi-agent threat discovery, automated exploit generation, and non-destructive live validation, applied to three commercial foundation models on two cloud architectures. Of 233 AI-discovered threats, 103 were confirmed and 34 refuted, giving 75.2% precision. Using multiple models increased coverage rather than agreement, yielding 2.2 times the confirmed threats of the best single model.
In briefAgents of Chaos: A Knowledge Systematization on Malicious Attacks Against Agentic AI
SummaryThis paper systematically reviews malicious attacks on agentic AI systems, which extend large language models with tools, memory, and code execution. The authors screened 186 sources, retained 98, and identified 284 atomic attacks, 452 safeguards, and 660 attack-safeguard relationships. Tool, MCP, and action-layer attacks make up the largest share, while prompt-injection and action-hijacking attacks have the broadest coverage. Safeguard coverage is uneven, with only 278 of the 660 relationships directly assessed.
Thanh M. Truong-Le, Amber Bennoui, Hoang-Ly Nguyen et al.
In brief"The Devil Wears Markdown": Detecting Hidden Malicious Intent in AI Agent Skill Instructions via Hybrid Static, Dynamic, and Agentic Analysis
SummaryThe paper studies malicious intent hidden in reusable AI agent skills, which combine code, natural-language instructions, and configuration files. The authors evaluated three open-source scanners on a 140-skill test set (80 malicious, 60 benign). They propose a framework combining static findings, safety-constrained sandbox evidence, and LLM reasoning, which raised F1 from 0.70 to 0.85 with dynamic evidence and to 0.89 with static and dynamic evidence combined, yielding five false positives among the 60 benign skills.
Thanh M. Truong-Le, Amber Bennoui, Hoang-Ly Nguyen et al.
In briefSIExBench: A Benchmark for Automatically Repairing Sensitive Information Exposure Bugs
SummaryThis paper introduces SIExBench, the first benchmark dedicated to automated repair of sensitive information exposure (SIEx) defects. It contains 161 execution-verified instances drawn from 64 Python and Java repositories. Evaluating six repair systems with three LLMs across 18 configurations, the best setup resolves only 39.1% of instances, and 62.1% of failed attempts produce patches that still leave information exposed.
WhyThe authors present the first benchmark for automated repair of sensitive information exposure, evaluating 18 configurations, with the best resolving 39.1% of instances.
