Translating C to Rust is one way to reduce security vulnerabilities. Large language models (LLMs) can aid in translation. One common translation strategy uses LLM queries. We present an alternative agentic approach that gives an LLM freedom and guardrails, and a publicly available implementation named ACTOR that outperforms all previous tools.
This article explores the capabilities of artificial intelligence (AI)/machine learning-assisted and fully agentic AI agents in transportation, highlighting that security risk tracks autonomy. It also discusses how to secure AI agents and enhance protection against security threats.
We study progress-guided test generation for agentic C-to-Rust transpilation. Compared to prompt-only generation, progress guidance uncovers additional bugs. The gains depend on the form of guidance and involve higher cost, suggesting that coverage alone is an incomplete signal.
Firmware is vital and often unseen layer in computing stack, crucial for security, coordination and operations in multiple domains that rely on accelerators and distributed control. This article provides systems-oriented view of firmware and explores its evolving role.
Researchers have proposed static-analysis-based techniques to replace C features with safe, idiomatic Rust features. We present PROCTOR, an extensible C-to-Rust translation framework that combines these techniques to facilitate the practical translation of C programs to Rust.
We introduce a safe abstraction to encapsulate unions for type punning during C-to-Rust translation by leveraging established safety conditions for type reinterpretation. We propose static analysis and program transformation techniques to replace such unions with this abstraction.
Coding agents accelerate C-to-Rust migration, but mature systems code exposes limits in verification, planning, and long-horizon consistency. Scalable migration requires an agentic harness with persistent state, dependency tracking, separated planning and review, and behavioral cross-checking.
Older adults, or their caregivers, must be aware of cyber scams. Unfortunately, many are not. We discuss the current data about this problem here.
We always underestimate the power of Merton’s law of unintended consequences. Minor, administrative decisions in the funding of vulnerability identification programs and in the regulation of mobile operating systems shifted the cyber world powers in ways worth the plot of a spy movie.
This essay surveys the evolution of cybersecurity from its conceptual origins to contemporary state-sponsored and AI-driven threats. By tracing major technical milestones, landmark incidents, and even SF influences, the timeline offers a scannable narrative mapping this ongoing socio-technical arms race.
In this special issue, we present an exciting “tasting sampler” of contextual integrity (CI) in application. Rooted in philosophy, CI offers an alternative to mainstream privacy definitions, which have struggled to address novel threats posed by powerful digital technologies and have yielded ineffective regulation.
Cloud computing offers many advantages but also changes the threat model. Hardware-based confidential computing is a promising new technology that can address some of the new threats.
This article argues that privacy protection should move beyond protecting the “real me” as the holder of personal data and toward protecting the “statistical me”: the inferred, model-generated version of myself that artificial intelligence systems construct, remember, and act upon.
The LLL algorithm has become a fundamental tool in cryptography. In addition to its many applications in cryptanalysis, it plays a central role in the security analysis of many post-quantum cryptographic constructions, including Kyber and Dilithium.
We reflect on the evolution of cybersecurity over the last 80 years, highlighting milestones, incidents, and institutional responses. We reveal recurring cycles, emphasizing cybersecurity as an ongoing process shaped by technology, exploitation, crisis, and institutional response.
This article discusses a hybrid triage pipeline that integrates static application security testing with large language models to provide an intelligent triage and automated exploit generation, reducing false positives by 91% in real-world deployments.
Three cybersecurity experts from academia and industry discuss the reasons why many phishing training programs fail to change behavior, the importance of meaningful measures of effectiveness, and strategies for improving organizational resilience against current and future phishing threats.
Salt Typhoon prompted urgent calls for quantum-secured telecommunications, but would it have helped? We analyze all documented attack techniques and find that 79%-93% exploited device-level vulnerabilities that "quantum security" cannot address.
The benchmarks used to evaluate AI agents in security-critical roles suffer from crucial weaknesses. Building on recent empirical evidence, we characterize three core challenges that undermine security evaluations: benchmark vulnerabilities, temporal staleness, and runtime uncertainty. We then outline practical directions toward building more robust and trustworthy evaluation frameworks.
