Research

Large language models are no longer just coding assistants; they are being deployed as automated vulnerability detectors in real-world systems. Anthropic’s Claude Opus recently discovered dozens of zero-day vulnerabilities in Mozilla Firefox, GitHub’s Copilot Autofix reviews pull requests and triages security alerts in CI/CD pipelines, and AppSec platforms like ZeroPath use LLMs to find and fix vulnerabilities. As these models take on the role of automated security gatekeepers, the reliability of their security verdicts becomes critical.

Decades of psychology research have shown that humans often rely on cognitive heuristics, or mental shortcuts, to make judgments under uncertainty. Since LLMs are trained on massive corpora of human-generated text, they inherit these same patterns in question answering, evaluation, and general reasoning. Prior work on LLM-driven vulnerability detection has focused almost entirely on the code itself. But LLM-based scanners in deployment do not see code in isolation; they routinely receive non-code context such as author identity, task directives, documentation strings, commit messages, and static analysis results alongside the code under review. This context can read as either reassuring or alarming to the model, and if a vulnerability detector is biased by these signals, it can reach different verdicts on identical code depending on who wrote it, how the task is phrased, or what the prior verdict was, none of which should matter in a security analysis.

In this work, we present the first systematic investigation of cognitive heuristics in LLM-based vulnerability detection. We design a controlled framework that holds the code fixed and varies only the surrounding context, evaluating three heuristics, halo, framing, and anchoring, across eight LLMs and three programming languages. Beyond documenting these biases, we ask whether they can be exploited adversarially: we build a proof-of-concept attack that forges commit metadata and fabricated prior scan results to suppress detection in a simulated CI/CD scanner, and we test whether prompt-based defenses can stop it.

LLMs like GPT-4 have been used extensively in code-level security testing. Natural language is difficult; it is unstructured and inherently ambiguous. To assess GPT-4’s capabilities in this domain, we first adopt a zero-shot approach that relies solely on the specification text without any external guidance. On surface level, the results are impressive: GPT-4 is highly effective in detecting high-level logical inconsistencies, weak validation checks, misconfigurations, and ambiguous protocol rules. Examples include improper handling of de-registration request with switch-off indication, inaccurate updating of 5G-GUTI, ambiguous guidelines for SNPN-specific attempt counters, and so on. Althogether GPT-4 identified 25 potential vulnerabilities, of which 12 are new. We tested eight of them and found four true-positives, the remaining four were false-positives. So, on its own GPT-4 is prone to hallucination. Further, GPT-4 is unable to identify advanced, low-level security flaws such as cryptographic weaknesses, exploitable timing and race condition attacks, network layer exploits (including downgrade attacks), and particularly attacks that involve multiple states or entities.

To uncover deeper, protocol-level attack vectors with greater precision, GPT-4 needs domain-specific contextual understanding. For this we introduce a novel domain-aware strategy, where we explicitly teach GPT-4 about security properties and hazard indicators from related works using few-shot learning. We further employ chain-of-thought prompting to guide the model through structured reasoning steps to identify violations or exploitations that may lead to vulnerabilities. Using the domain-aware approach, we have identified 24 potential vulnerabilities, including 15 new. These include sophisticated vulnerabilities like multi-state and cross-procedure attacks, cryptographic and integrity violations, message spoofing, injection, privacy and identity exposure, and resource management exploits. We tested SIX of these vulnerabilities and confirmed FIVE.

We also compared our findings against a white-box model, Mobile-LLaMA, and found that GPT-4 is more capable of finding both logical flaws and real-world exploits.

Encoder models are designed to aggregate all token embeddings into a single representation, called the [CLS] token, which is later used for downstream tasks like classification. Although it is convenient, the over-reliance on a single representative token can make encoder models insufficient in capturing fine-grained contextual nuances or localized cues critical for tasks like emotion recognition or irony detection [left figure]. This issue is even more pronounced in multi-label tasks, which require token-level attention rather than a single sequence-level summary.

In this work we propose Inceptive Transformers – a lightweight and modular architecture that augments a transformer baseline by stacking an inception-style 1-D convolution module on top. Instead of using [CLS]-based pooling, we feed the final hidden states from the baseline transformer (e.g. RoBERTa or BioBERT) to a multi-scale feature extraction module. This inception module employs parallel 1-D convolutional filters with varying kernel sizes that are designed to recognize local features, such as key phrases or word combinations that are indicative of specific classifications. The goal of the inception module is to incorporate local features without sacrificing global context, which is achieved by using a residual connection to concatenate the original transformer’s hidden states with the multi-scale features. These enriched features are then processed by a self-attention mechanism, which dynamically assigns weights to tokens based on their task-specific contribution, thus allowing the model to effectively prioritize relevant tokens.

Our experiments demonstrate that Inceptive Transformers consistently outperform both general-purpose baselines (like RoBERTa and DeBERTa v3) and domain-specific ones (like BERTweet and BioBERT). On five different tasks (Bangla and English emotion recognition, irony detection, disease identification, and anti-vaccine concern classification), we observed performance gains from 1% to as high as 14% in accuracy and F1-score, with less than 10% inference-time overhead.

The rapid shift from passive LLMs to autonomous LLM-agents marks a new paradigm in cybersecurity. While these agents can act as powerful tools for both offensive and defensive operations, the very agentic context introduces a new class of inherent security risks. Existing surveys provide valuable insights into specific aspects like security threats, trustworthiness, enterprise governance and core LLM safety, but they fail to capture the complete picture, leaving practitioners and researchers without a unified framework for understanding how agent capabilities, vulnerabilities, and defenses interconnect.

In this work we present the first holistic survey of the agentic security landscape, structured to answer three key questions a security researcher would ask: “What can agents do for my security?” (Applications), “How can they be attacked?” (Threats), and “How do I stop them?” (Defenses). To this end, we define three pillars of taxonomy:

• Applications. Using LLM-agents in downstream cybersecurity tasks, including red teaming (autonomous vulnerability discovery), blue teaming (defending against threats), and domain-specific security (cloud, web).
  
• Threats. Security vulnerabilities inherent to agentic systems that attackers can exploit.
  
• Defenses. Techniques and countermeasures used to harden agentic systems against the threats.

By uniquely bridging these three pillars, we provide a complete picture of the current state of the art, transforming a scattered collection of individual research efforts into an actionable body of knowledge. Additionally, we identify key trends and critical gaps in existing literature.

• Security-lifecycle coverage is highly uneven.
  
• Offensive and defensive agents are diverging in autonomy. Offensive systems are converging on full autonomy while defensive systems still rely on human approval.
  
• Red teaming agents are inherently dual-use.
  
• The agentic failure stage is often different from where the attack enters.
  
• The most studied threats to agentic systems are the ones that carry over from the base LLM, or get amplified due to agentic scaffolding. The purely agent-native threat surfaces, such as inter-agent communication, memory and reflection stages, are simultaneously the least attacked and the least benchmarked.
  
• No defense strategy is adequate alone.
  
• Stronger protection costs more time and tokens.
  
• Defense coverage does not match the threat distribution.