Stack layer / Threat pattern
Handing a coding agent false-positive templates doubles its success at writing CodeQL refinements, from 28% to 56-62%
arXiv 2609.04535
Stack layer / Threat pattern
SBOM Tools Cover Only the First Two of Four Supply-Chain Propagation Stages
arXiv 2609.05380
Policy dependency / Stack layer
MCP ext-apps migrated to SDK v2 across 125 files to cut a server-to-client dependency edge
GitHub
Stack layer / Threat pattern
TIER Replaces Binary Safety Scores With a Six-Label Behavior Scale Across Four Threat-Implicitness Levels
arXiv 2609.05117
Policy dependency / Stack layer
CPMI and IOSCO Published a Cyber Resilience Toolkit for Financial Market Infrastructures
Finextra
Stack layer / Threat pattern
Codex users are getting 'Cyber Abuse' warnings from OpenAI for security-reviewing their own code, with appeals rejected then reversed
r/OpenAI (79 upvotes, 58 comments)
Stack layer / Threat pattern
LLM decompiler output that recompiles and passes every shipped test still diverges on other inputs, and can silently erase a disclosed CVE
arXiv 2609.05370
Policy dependency / Stack layer
Hierarchical Ransomware Agents Escalate to Dynamic and Memory Analysis Only on Specialist Disagreement
arXiv 2609.04820