From Investigation Failures to Reliable SOC Agents: Understanding and Improving LLM-Based Alert Triage

Security operations centers SOCs must triage large volumes of alerts, most of which are benign, while missed attacks can remain uninvestigated. Tool-using large language model LLM agents can retrieve evidence during triage, but it remains unclear how reasoning strategies determine what to gather...

Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code's Auto Mode

Claude Code's auto mode is the first deployed permission system for AI coding agents, using a two-stage transcript classifier to gate dangerous tool calls. Anthropic reports a 0.4% false positive rate and 17% false negative rate on production traffic. We present the first independent evaluation o...

ALFA: A Safe-By-Design Approach to Mitigate Quishing Attacks Launched Via Fancy QR Codes

Phishing with Quick Response QR codes is termed as Quishing. The attackers exploit this method to manipulate individuals into revealing their confidential data. Recently, we see the colorful and fancy representations of QR codes, the 2D matrix of QR codes which does not reflect a typical mixture ...