kong

Kong: The Agentic Reverse Engineer LLM orchestration for reverse engineering binaries What is Kong? Most tasks follow a linear relationship: the more difficult a task, the longer it usually takes. Reverse engineering and binary analysis is a task in which the actual difficulty is somewhat trivial...

www-project-top-10-for-large-language-model-applications

www-project-top-10-for-large-language-model-applications OWASP Foundation Web Repository OWASP Top 10 for Large Language Model Applications Welcome to the official repository for the OWASP Top 10 for Large Language Model Applications! About This Repository This repository contains the OWASP Top 1...

oss-fuzz-gen

A Framework for Fuzz Target Generation and Evaluation This framework generates fuzz targets for real-world C/C++/Java/Python projects with various Large Language Models LLM and benchmarks them via the OSS-Fuzz platform. More details available in AI-Powered Fuzzing: Breaking the Bug Hunting Barrie...

batch_jailbreak

Official Repo for Safety in Batches? Understanding and Mitigating Safety Failures in Batch Prompting Kihyun Kim, Hee-Seon Kim, Wonjun Lee, Changick Kim Korea Advanced Institute of Science and Technology KAIST News 2026.09 Our paper has been accepted to AACL-IJCNLP 2026 Main! 🎉 2026.08 Paper is...

birdy-edwards

BIRDY-EDWARDS 2.0 Infiltrate & Expose Automated AI powered Facebook intelligence tool for target profiling, network analysis and threat reporting. Runs entirely on-device via Ollama. AI-powered Facebook SOCMINT platform — 100% local, zero cloud dependency. For lite version check this repo click...

markdown-exfil-tester

valtik-markdown-exfil-tester Black-box tester for indirect prompt injection leading to markdown / HTML exfiltration in LLM-backed chatbots. This is the vulnerability class that hit Microsoft 365 Copilot CVE-2025-32711, aka EchoLeak, ChatGPT OpenAI Feb 2026 patch, and Salesforce ForcedLeak. The...

EUVD-2026-96609

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to run AI prompt experiments. Low-privileged attackers can supply other users' prompt template and dataset ids to trigger large...

FinRT: Distilling Adaptive Red-Teaming Strategies into Reusable Adversarial Generators in Consumer Finance

In regulated industries like consumer finance, seemingly harmless user queries can exploit large language model vulnerabilities, triggering safety failures and pushing responses dangerously close to policy limits. Existing automated red-teaming methods trade off attack effectiveness against...

API Secrets Should Never Become Tokens in the LLM's Vocabulary

Tool-using large language model LLM agents turn credential hygiene from a storage problem into an execution-security problem. A key pasted into a prompt, or embedded in a system prompt or tool configuration, crosses from an authentication boundary into a data pipeline, where it may persist in...

Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language Model

This paper presents a controlled post-alert incident orchestration and response subsystem for educational information systems. The architecture separates deterministic classification, contextual analysis, human approval, and technical execution. A Rule Engine determines severity and selects the...

Towards Tackling Application Logic Flaws through Autonomous Formal-Logic Modeling and Automated Reasoning

Logic flaws pose significant challenges in the design and implementation of modern, semantically rich systems and applications, impacting security, privacy, and trust. These flaws are inherently tied to business-specific semantics and threat models, making their discovery and reasoning difficult...

A Queryable Graph-Based Security Analysis Framework for O-RAN

The Open Radio Access Network O-RAN replaces vendor-locked RANs with a modular and interoperable architecture that fosters competition and accelerates innovation. With this openness comes increased complexity and a larger attack surface, making security a critical concern. Today, assessing O-RAN...

Using LLMs to Elicit Security Requirements for Service-Oriented Cyber Ranges

Cyber ranges are complex environments comprising many interacting components and stakeholders with different security concerns. The Service-Oriented Cyber Range SOR is no exception, particularly when it comes to training scenarios targeting critical infrastructure. Security concerns are translate...

Are We Shooting Flies with Cannons? Trade-Off Analysis for AI-Based 5G Intrusion Detection

The increasing adoption of Artificial Intelligence AI in network intrusion detection raises the question of whether complex and computationally expensive models are justified for this task. In this work, we investigate the trade-off between detection performance and computational cost for intrusi...

recon-arc

ReconARC 🔍 Advanced Reconnaissance & Attack-path Ranking Co...

LLM-Assisted Detection and Repair of Hardware Security Vulnerabilities in Verilog Designs

Hardware designs, like software, are susceptible to bugs that can introduce security vulnerabilities and create opportunities for malicious exploitation. Unlike software vulnerabilities, however, hardware flaws become permanently embedded in silicon after fabrication, making them difficult or...

Hardware Design and Security in the Era of Chiplets and LLMs

The semiconductor industry is undergoing a dual revolution: the shift toward heterogeneous 2.5D chiplet systems and the integration of Large Language Models LLMs into Electronic Design Automation EDA flows. While these paradigms offer unprecedented benefits in yield, modularity, design...

MalTotal: Cost-Effective and Language-Agnostic Malicious Code Poisoning Detection for Millions of Repositories

The widespread adoption of open source software OSS has introduced significant security risks, with malicious code poisoning attacks increasingly targeting public package registries and open-source platforms. Existing detection approaches, including heuristic-, learning-, and LLM-based methods,...

A Security-Oriented Lifecycle Model for Large Language Model Systems

Large language models are being integrated into critical infrastructure and enterprise workflows at unprecedented scale,yet the lifecycle frameworks governing their development and operations were designed for operational efficiency rather than security analysis. As a result, security-relevant...

EUVD-2026-52405

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...