Aug 2026· International Journal of Digital Research· 0 citations
TL;DR
An operational blueprint for an Autonomous Defensive Layer (ADL) is suggested that enforces tight micro-virtualization, continuous shadow reasoning execution, and deterministic formal verification pipelines to safeguard the upcoming generation of computing runtimes.
Abstract
There is a structural shift in software engineering that has never been seen before. Deterministic, human-written source code is giving way to dynamic computing environments powered by artificial intelligence that can program itself. These multi-agent architectures create, assemble, and run real-time operating environments on their own. This fluid movement exposes computer infrastructure to systemic, deep architectural vulnerabilities even while it promises historic improvements in hardware flexibility and execution speed. Software contexts that dynamically rewrite their own execution logic cannot be secured using traditional cybersecurity techniques, particularly static analysis, signature detection, and perimeter protection.
The vulnerabilities present in unsupervised automated system compilation are thoroughly examined in this research. We model target threat vectors, such as the compression of zero-day discovery-to-exploit lifecycles by adversarial models, the amplification of design vulnerabilities during unsupervised generation, and excessive agency across multi-layered execution environments. In order to show that using secondary reasoning models for auditing results in common logical blind spots and systemic failure routes, we explicitly analyze the cognitive recursive loop dilemma ("Who Watches the Watcher?" conundrum). We designate automated mathematical validation as the ultimate gatekeeper for dynamic system compilation in order to overcome this structural constraint. We demonstrate the specific dangers of unverified synthesis using recent real-world case studies including flaws in autonomous developer interfaces and automated schema deployment tools. In order to safeguard the upcoming generation of computing runtimes, we finally suggest an operational blueprint for an Autonomous Defensive Layer (ADL) that enforces tight micro-virtualization, continuous shadow reasoning execution, and deterministic formal verification pipelines.
SRE-Bench is introduced, the first realistic, contamination-free RE benchmark, and results indicate that strong source-code security capabilities do not yet transfer to binary analysis, highlighting RE as an important frontier for agentic cybersecurity and SRE-Bench as a rigorous testbed to measure progress.
J. Spence, Nicholas Assaderaghi, Jinhao Zhu et al.· 0 citations
Despite recent advances, frontier large language model (LLM) agents remain limited in discovering and patching complex vulnerabilities in real-world software. Generally available agents can already aid attackers, who only need to find one exploitable weakness, while defenders must continuously identify and patch all vulnerabilities across fast-growing codebases. Stronger defensive agents would help close this gap, yet the scarcity of security training data with reproducible build and execution environments remains a bottleneck. We present CyberForge, a framework that synthesizes executable, repository-level security training data by injecting vulnerabilities into real C/C++ projects. It validates each instance dynamically: the injected build must pass the project's unit tests, and generated proof-of-vulnerability (PoV) must trigger on the injected build and not on the clean one. CyberForge is not limited by the availability of disclosed vulnerabilities, therefore it can scale in comparison to data augmentation techniques which rely on historic CVE data. The resulting corpus holds 1034 validated vulnerabilities across 80 projects and 63 weakness categories, with edit locality similar to real CVE patches under a real-versus-real noise floor. Fine-tuning on trajectories collected over this corpus improves SEC-bench patch repair by +3.3 to +14.7 points, in all six configurations of three model scales and two teachers, with the 31B student reaching its GPT-5.4-mini teacher, 72.7% against 74.0%. These gains generalize out of distribution to PatchEval, a corpus containing other programming languages, where every configuration also improves and the 31B student passes its teacher.
Amine Lbath, Manan Suri, A. Delaitre et al.· 0 citations
The results show that build integration, not candidate generation or fuzzing, is the primary barrier to reliable LLM-assisted dynamic analysis of full autonomous-vehicle software stacks.
This paper organizes the area into a structured taxonomy along five axes: the de-tection capability targeted, the analysis paradigm employed, the agent archi-tecture, the degree of autonomy, and the evaluation methodology.
Andi Xia· Poster Volume 0008 The 2026...· 0 citations
StackPatroller is proposed, a stack-integrity-based runtime supervision framework that enforces program integrity through configurable policies that monitors runtime stack contexts to detect early deviations from normal execution, enabling the identification of whole-function reuse and certain forward-edge attacks earlier—within user mode before any unintended system calls occur.
Yuanheng Xu, Si-Yu Zhang, Juan Wang et al.· Journal of computing and sec...· 0 citations
Software security has been a long-standing and prominent topic in both industry and academia. However, with the increasing deployment of smart devices across various architectures, there is now a significant demand for cross-architecture software. For instance, the Heartbleed vulnerability (CVE-2014-0160), classified as CWE-125 (Out-of-bounds Read) and disclosed in the OpenSSL library in 2014, serves as a prime example of a widely-deployed software vulnerability capable of affecting systems across diverse computing environments due to OpenSSL’s broad adoption. More broadly, memory-related vulnerabilities remain a persistent and significant threat, accounting for a substantial proportion of reported CVEs in recent years. Moreover, performing static cross-architecture vulnerability analysis on binary code poses particular challenges due to the variations in instruction sets across different architectures. In this paper, we present a novel static approach, called BinCros, to identify known vulnerabilities across different optimization levels and CPU architectures in binary code. It mainly consists of three phases: 1) Generating ground-truth intermediate representation (IR) data from binary code based on domain knowledge. To address the cross-architecture problem, we consider IR, which is a set of smaller, lower-level instructions that break down, describe, and capture all the effects of an instruction from standard architectures like x86, ARM, and MIPS; 2) Learning good embeddings based on the cross-architecture ground-truth datasets. We employ a code-code learning method to capture the semantic differences and maximize the distribution divergences between vulnerable and non-vulnerable samples; 3) Building a prediction model based on high-level feature representations. To demonstrate the effectiveness of BinCros, we conducted experiments with a series of baselines including single architecture-based techniques, cross-architecture-based techniques, and so on. Experimental results show that BinCros outperforms the baselines by at least 15% in terms of F1-measure in almost all cases. We believe this work will inspire other researchers to consider natural language processing-related techniques for cross-architecture software vulnerability detection.
Shigang Liu, Di Cao, Chao Chen et al.· IEEE Transactions on Informa...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
