Singapore Management University

Unsafe deserialization lets attacker-controlled data trigger chains of existing methods and reach code execution, while gateway, application and system controls each see only part of the attack. Janus runs a black-box attacker agent against an isolated replica to surface exploit variants, has a defender agent summarize each verified variant into security-relevant effects, and uses counterfactual replay to separate complementary coverage from redundant enforcement before jointly selecting and scoping controls. Across 16 deployments in six Java and PHP applications, held-out attack success falls to 6.2% versus 18.8%–55.0% for gateway, application, system and cross-layer baselines, while 98.4% of benign functionality tests pass.

Unsafe deserialization lets attacker-controlled data trigger chains of existing methods and reach code execution, while gateway, application and system controls each see only part of the attack. Janus runs a black-box attacker agent against an isolated replica to surface exploit variants, has a defender agent summarize each verified variant into security-relevant effects, and uses counterfactual replay to separate complementary coverage from redundant enforcement before jointly selecting and scoping controls. Across 16 deployments in six Java and PHP applications, held-out attack success falls to 6.2% versus 18.8%–55.0% for gateway, application, system and cross-layer baselines, while 98.4% of benign functionality tests pass.

MemForm splits how an LLM agent's long-term memory is formed into five intervenable interfaces, and across six models and two response formats all five showed behavior being rewritten.

MemForm splits how an LLM agent's long-term memory is formed into five intervenable interfaces, and across six models and two response formats all five showed behavior being rewritten.

Coding-agent evaluation becomes a duel in which two agents author and solve each other's tasks: over 1,500 turns, GPT-5.5 with Codex CLI repaired 98.3% of the defects it reviewed, while Claude Opus 4.8 with mini-swe-agent was the strongest task author with a 27.3% Red win rate.

Coding-agent evaluation becomes a duel in which two agents author and solve each other's tasks: over 1,500 turns, GPT-5.5 with Codex CLI repaired 98.3% of the defects it reviewed, while Claude Opus 4.8 with mini-swe-agent was the strongest task author with a 27.3% Red win rate.

Reasoning models draft code early inside their chain of thought, and SecReason scans the streaming tokens before delivery and inserts a warning so the model repairs the draft within the same reasoning trace, raising the share of runs that are both secure and functionally correct from below 15% to 72.8%–98.1%.

Reasoning models draft code early inside their chain of thought, and SecReason scans the streaming tokens before delivery and inserts a warning so the model repairs the draft within the same reasoning trace, raising the share of runs that are both secure and functionally correct from below 15% to 72.8%–98.1%.

HASTE is a multi-agent framework that evolves agent harnesses from sparse threat evidence, such as brief descriptions or a few attack examples in threat reports and preprints, through an adversarial interplay between safety-specification generation and attack-case generation, feeding evaluation outcomes back into both processes so harnesses evolve against emerging attacks beyond the initially observed evidence; experiments across multiple backbone models, attack types, and evidence forms show it consistently reduces attack success rates while preserving benign-task utility.

HASTE is a multi-agent framework that evolves agent harnesses from sparse threat evidence, such as brief descriptions or a few attack examples in threat reports and preprints, through an adversarial interplay between safety-specification generation and attack-case generation, feeding evaluation outcomes back into both processes so harnesses evolve against emerging attacks beyond the initially observed evidence; experiments across multiple backbone models, attack types, and evidence forms show it consistently reduces attack success rates while preserving benign-task utility.