Software Security

Ask about this topic

Overview

Software security examines how flaws arise in programs and systems, how attackers can exploit them, and how developers can prevent or fix them. Common approaches include static analysis and taint tracking, dynamic testing and fuzzing, dependency and vulnerability analysis, threat modeling, and formal verification. Large language models and coding agents are increasingly applied to vulnerability detection, exploit reproduction, and patch generation, with evaluation using CWE- and CVE-based tasks, fuzzing targets, and smart-contract tests. A central challenge is that functional tests and static checks do not establish security: tools must balance missed flaws against false alarms, and generated fixes need realistic validation before deployment.

Latest papers

CardsList

95 papers13 papers in the last four weeks, up 18% on the four weeks before. 0.1% of all new papers.

  1. Beyond Copying: Lifelong Smart Contract Security Task Construction via Protocol Mutation

    Oct 23, 2026Zifan Peng, Peng Huang, Jingyi Zheng +5Software SecuritySynthetic Benchmark Generation

    Shanghai Artificial Intelligence Laboratory · The Hong Kong University of Science and Technology (Guangzhou) · University of Science and Technology of China +1

  2. WADE: An LSTM-Based Anomaly Detection Engine for WebAssembly Applications

    Oct 22, 2026Ilaria Campestrini, Stefano Zanero, Engin KirdaSoftware SecurityAnomaly Detection

    Politecnico di Milano, Milan, Italy · Northeastern University, Boston, MA, USA

  3. Many Repairs, One Direction: Steering Code Models Toward Safer Cryptographic API Use

    Oct 18, 2026Tianhe Lu, Sakuna Harinda Jayasundara, Eric Spero +3Secure Code GenerationLLM Code Generation

    University of Auckland Auckland, New Zealand

  4. P2Patch: Exploit-Guided Vulnerability Repair

    Oct 14, 2026Mohsen Iranmanesh, Sina Moradi Sabet, Sina Marefat +7Automated Exploit GenerationAutomated Program Repair

    Simon Fraser University, Canada · Amirkabir University of Technology, Iran · K. N. Toosi University of Technology, Iran +1

  5. Nudge the Judge: Uncovering Program Decision Hijacking in Real-World Jev Applications

    Oct 13, 2026Yang Luo, Tiantian Ji, Zifeng Kang +4Software SecurityPrompt Injection Attacks

    Key Laboratory of Trustworthy Distributed Computing and Service (MoE), Beijing University of Posts and Telecommunications · Beijing University of Posts and Telecommunications · Zhongguancun Laboratory +1

  6. Security in LLM-Assisted Coding: A Systematic Literature Review

    Oct 11, 2026Liang Yuan, Maryam Khanian Najafabadi, Mashud Rana +1LLM SecuritySoftware Security

    Australian Catholic University, North Sydney, New South Wales, Australia

  7. Last Secure Code Benchmark: Is the Code You Vibe Secure?

    Oct 10, 2026Tianyi Wu, Chao Ge, Peng Chen +12Secure Code GenerationAI Agent Security Benchmarks

    National University of Singapore · Qwen Team, Alibaba Token Hub, Alibaba Group · Cloud Safety and Security, Alibaba Cloud, Alibaba Group

  8. Polar: LLM-Powered Synthesis of Real-World Cyber Evidence for Prioritization and Mitigation

    Oct 5, 2026Luoxi Tang, Yuqiao Meng, Ankita Patra +3CybersecurityCyber Threat Intelligence

    Binghamton University, State University of New York, Binghamton, NY, USA · Oakland University, Rochester, MI, USA · University of Iowa, Iowa City, IA, USA

  9. Where Did the Repair First Go Wrong? Localizing the Origins of Silent Failures in Agentic Vulnerability Repair

    Oct 5, 2026Wenji Bai, Muhammad Waseem, Zeeshan Rasheed +2Agent Failure AnalysisAutomated Program Repair

    Tampere University, Tampere, Finland

  10. From Requirements to Attack Trees: Grounded LLM Agents for Design-Time Security Review

    Oct 2, 2026Akash Iyer, Taha Demirkan, Keerthi Koneru +3CybersecuritySoftware Security

    Center for Advanced AI, Accenture

  11. AuraForge: Scaling Security Supervision for Training Coding Agents

    Oct 1, 2026Danqing Wang, Songwen Zhao, Harsh Sharma +4AI Coding AgentsSoftware Security

    Carnegie Mellon University · University of California, Los Angeles · ScOp Venture Capital.

  12. Proof-Gated Signing: Solver-Checked Transaction Guards that Hold Under State Drift for Onchain AI Agents

    Sep 30, 2026Bravish GhoshAI Agent SecuritySoftware Security

    Independent Researcher

  13. SecureVibe: Making Vibe Coding More Secure

    Sep 29, 2026Danqing Wang, Baolin Peng, Zhepei Wei +8Secure Code GenerationSoftware Security

    Carnegie Mellon University · Microsoft Research · University of Virginia, Charlottesville +1

  14. API Secrets Should Never Become Tokens in the LLM's Vocabulary: A Threat Analysis of API Credential Handling in LLM Agent Systems and an Empirical Evaluation of a Vault-Mediated Execution Boundary

    Sep 27, 2026Patrick Kenney, Hadi Ahmadi, Denis Lusson +2Software SecurityLLM Agent Security

    Corvic AI Research

  15. Evaluating Coding Agents on Kernel Exploit Generation

    Sep 22, 2026Junyoung Jang, Gwanhyun Lee, Hwiwon Lee +4AI Coding AgentsSoftware Security

    Independent Researcher · University of Illinois Urbana-Champaign · Ministry of National Defense, Republic of Korea

  16. SyzHarness: Patch-Based Kernel Bug Reproduction with LLM-Synthesized Fuzzing Harnesses

    Sep 20, 2026Xingyu Li, Juefei Pu, Haonan Li +4Software Vulnerability DetectionLLM-Based Program Synthesis

    University of California, Riverside

  17. Identifying Security Platform Product Abuse with Machine Learning

    Sep 18, 2026Shaefer Drew, Michael Brautbar, Paul Knight +6Software SecurityAnomaly Detection

    USA · CrowdStrike · Canada +2

  18. Inference-Engine Fingerprinting Attacks are Practical: Exploring Model-Driven Environmental Discovery, Exploitation, and Escape

    Sep 17, 2026Sarah Radway, Andrew Cheng, Vijay Janapa Reddi +1Language Model FingerprintingSoftware Security

    Harvard University

  19. Beyond Static Guarantees: Measuring the Static-Pass Dynamic-Fail Gap in Security-Sensitive and LLM-Generated Python Code

    Sep 9, 2026Jessica Pourleyli, Maitreyee Das Urmi, Glaucia MeloSoftware Vulnerability DetectionSoftware Security

    Toronto Metropolitan University Toronto, Canada

  20. Seeing is Not Believing: Breaking the Physical-to-Digital Trust Boundary in Robotics

    Sep 8, 2026Leming Shen, Shikai Geng, Yuanqing Zheng +1CybersecuritySoftware Security

    University College London · The Hong Kong Polytechnic University

  21. VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities

    Sep 7, 2026Jiahao Shi, Edward Tsien, Yifeng Di +10LLM Agent EvaluationSoftware Security

    Department of Computer Science, Purdue University · Red Hat

  22. CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation

    Sep 2, 2026Varun Gadey, Ziad Marey, Alexandra DmitrienkoRetrieval-Augmented Code GenerationData Poisoning Attacks

    University of Duisburg-Essen, Germany

  23. Automated Vulnerability Injection in Smart Contracts Using Large Language Models

    Sep 2, 2026Luca Migliaccio, Roberto Natella, Naghmeh Ivaki +2Software SecuritySoftware Vulnerability Detection

    Universit`a degli Studi di Napoli Federico II · Gran Sasso Science Institute (GSSI) · University of Coimbra, CISUC/LASI, DEI +1

  24. Athena: Vulnerability-Affected Library Identification via Knowledge Graph Completion

    Sep 1, 2026Phong Trinh Duy, Trang Dang Yen, Hung Nguyen-Huu +5Software SecurityKG Completion

    Hanoi University of Science and Technology, Vietnam · The University of Sydney, Australia · Singapore Management University, Singapore +3

  25. Approved Too Late: Verdict Staleness in LLM-Guarded Self-Adaptive Systems

    Aug 26, 2026Ilai Shraga, Roei Eshel, Lior GorelikLLM GuardrailsSoftware Security

    University of Cambridge Cambridge, United Kingdom · Maccabim-Re’ut High School Modi’in-Maccabim-Re’ut, Israel · The Open University of Israel Raanana, Israel

  26. MACGen: Toward Functionally Correct and Secure Code Generation via Multi-Agent Collaboration

    Aug 26, 2026Miseon Yu, Jaehoon Choi, Younghan Lee +1Code GenerationSecure Code Generation

    Seoul National University · Seoul, Republic of Korea · Sungshin Women’s University

  27. Evaluating and Preventing Security Smells in AI-Generated Ansible Code

    Aug 25, 2026Pandu Ranga Reddy Konala, Vimal Kumar, David Bainbridge +1Secure Code GenerationSoftware Security

    School of Computing and Mathematical Sciences, University of Waikato, Hamilton, New Zealand 3240

  28. Stale Does Not Mean Unsafe: Guard Precision for Tool-Using LLM Agents under Infrastructure State Races

    Aug 25, 2026Zihao Zheng, Jiayu Long, Baichuan Li +1Runtime Enforcement for AI AgentsLLM Agent Safety

    Washington University in St. Louis, St. Louis, Missouri, USA · Southern Methodist University, Dallas, Texas, USA

  29. CyberFactory: Scaling Cyber Security Capabilities with Instances from the Wild

    Aug 24, 2026Jian Yang, Haau-Sing Li, Shawn Guo +10Automated Exploit GenerationCybersecurity

    Beihang University · ELLIS · IQuest Research +1

  30. On Predicting Vulnerability Severity Using In-Context Learning: An Industrial Case Study

    Aug 22, 2026Daniel Rodriguez-Cardenas, David Nader Palacio, Anna Schmedding +8Software SecurityLLMs for Cybersecurity

    William & Mary Williamsburg, VA, USA · Microsoft Seattle, WA, USA · Cisco Systems San Jose, CA, USA