On June 24, 2026, we were honored to host Prof. Zhiqiang Lin (Distinguished Professor of Engineering, and Director of the Institute for Cybersecurity and Digital Trust, The Ohio State University) at our laboratory on the Nishi-Waseda campus. Prof. Lin gave a research talk followed by an open discussion with our students and invited researchers.
Title: Validated Exploits, Not LLM Claims: Runtime-Grounded Security Agents for AI-Generated Code
Abstract: AI coding agents are rapidly changing how software is produced, but they also create a new assurance problem: generated code can be deployed faster than humans can review it. This talk examines how large language models can be used not merely to flag suspicious code, but to construct evidence-backed security findings for full-stack web applications. Prof. Lin presented BuckAI, an LLM-agent pipeline for web vulnerability discovery that combines code reasoning, static analysis, automated deployment, exploit generation, and runtime validation. The central design principle is that LLMs should propose hypotheses, while validators and runtime oracles determine whether those hypotheses correspond to real, exploitable behavior. The talk covered the challenges of building such a system — the lack of runnable benchmarks, the difficulty of deploying diverse web applications, and the unreliability of LLMs as final security judges — and concluded with lessons for building trustworthy security agents and open research directions in agentic AI for software security.
We thank Prof. Lin for the stimulating talk and the lively discussions with our group, and we look forward to future collaborations.
