🕵️ THREAT RESEARCH & DEEP DIVES
Cross-Cutting Security Analysis of LLM-Generated Code via Metamorphic Testing and Association Rule Mining — arXiv cs.CR
A new framework combining metamorphic testing and association rule mining detects security vulnerabilities in LLM-generated code across multiple CWE categories (SQLi, XSS, command injection, path traversal, hard-coded creds, weak crypto, memory errors). Analysis of 3,700 code snippets reveals co-occurring weaknesses linked to prompt-level risk factors, highlighting systemic risks in AI-assisted coding.Antiproof: Synthesizing Vulnerability Detectors and Proofs of Exploitability — arXiv cs.CR
Antiproof introduces a neuro-symbolic system that synthesizes static vulnerability detectors with executable proof-of-exploit oracles, achieving 97% recall on benchmark datasets and improving detection recall by over 60 points compared to prior methods. This approach enables scalable, validated vulnerability discovery with automatic exploit confirmation.Trust but Verify? Uncovering the Security Debt of Autonomous Coding Agents — arXiv cs.CR
A large-scale study of 16,112 file changes from 4,022 autonomous agent-generated PRs reveals 38.9% contain security misconfigurations and code smells, exposing significant security debt in AI-driven software development. The work uses an LLM-based judge plus manual review to classify risks, underscoring urgent need for security controls in autonomous coding workflows.On the Security Implications of PQC in TLS: Handshake Exhaustion and IDS Degradation — arXiv cs.CR
Empirical testing shows PQC-enabled TLS 1.3 servers suffer prolonged high CPU load under handshake exhaustion DDoS attacks, exacerbating denial-of-service impact. The increased handshake complexity also degrades IDS detection efficacy, raising concerns about operational security trade-offs in early PQC deployment.When Binaries Talk Back: Representation-Confusion Attacks on LLM-Assisted Reverse Engineering — arXiv cs.CR
This study identifies Representation-Confusion Attacks (RARE) where attacker-crafted binaries manipulate LLM-assisted reverse engineering pipelines by misrepresenting data as instructions or evidence, causing false trust in analysis outputs. The paper introduces RARE-Bench and RARE-Guard, revealing new attack vectors against AI-powered RE tools.PVDetector: Detecting Prompt Injection Attacks on Purpose-Specific LLM Agents through Policy-Violation Concept Analysis — arXiv cs.CR
PVDetector analyzes hidden activation spaces in LLM agents to detect prompt injection attacks that bypass conventional input-output pattern checks. By identifying latent policy-violation concepts, it offers a novel detection layer for securing domain-specific LLM agents against stealthy manipulation attempts.Bulkhead: Automated Semantic Detection and Remediation of Container Escape Vulnerabilities — arXiv cs.CR
Bulkhead addresses path traversal vulnerabilities in container environments caused by cross-boundary path misresolution, especially in cloud AI workloads sharing GPUs and agent workspaces. It automates semantic detection and remediation without intrusive kernel changes, improving container isolation security against escape attacks.A Scalable Cloud-Orchestrated and Service-Oriented Multi-Domain QKD Network with PQC Integration — arXiv cs.CR
A new multi-domain quantum key distribution (QKD) network architecture integrates vendor-agnostic QKD, SDN orchestration, and PQC-based trust services. Deployed on a real testbed with multiple vendors, it enables scalable, interoperable quantum-secure communications across heterogeneous infrastructures, advancing practical quantum-resistant network security.
📰 LESSER-KNOWN / UNDER-REPORTED
Open-Source Intelligence for Code Provenance and the Security Patterns that Separate Human and Large-Language-Model Implementations of Common Programming Tasks — arXiv cs.CR
This study uses OSINT and public LLMs to differentiate code provenance between human and AI sources for 31 security-sensitive tasks (OAuth, JWT, password hashing). It finds distinct security pattern adoption differences, enabling provenance attribution and highlighting potential security gaps in AI-generated code.Auditable and Transparent Fully Authenticated Disk Encryption via USB Storage Interposition — arXiv cs.CR
Proposes a novel FDE approach using an inline USB device running Linux to provide fully authenticated encryption and auditability outside the host OS. This method offers transparent encryption with stronger assurance and forensic capabilities, potentially improving endpoint disk security without kernel modifications.