AXE
Turning localized vulnerability reports into reproducible proof-of-concept exploits through planning, source inspection, and sandboxed execution.
Computer science · Drexel University
Software security and AI
I study security risks in AI-generated code and develop methods for vulnerability analysis and exploitability confirmation.
My earlier work examined interpersonal trust and emotions in developer conversations, and the use of psycholinguistic tools in software engineering.
Research theme 01
Exploitation and red teaming
Exploitability confirmation, agent trajectory analysis, and planned exploit-based red teaming.
Papers and detailsVulnerability reports and AI agents
Studying how the information in a vulnerability report affects an agent’s ability to produce a working exploit.
TraceView
An interactive way to inspect how coding agents reason, use tools, repeat themselves, and arrive at a patch.
Research theme 02
Improving static vulnerability analysis
CodeQL false positives, query refinements, agent adaptation, and developer feedback.
Papers and detailsCodeQL false positives and query refinements
Recurring causes of false positives in CodeQL and query refinements evaluated on Java vulnerabilities.
Research theme 03
Understanding security risks
Security awareness in programming assistance and vulnerabilities introduced by AI-generated patches.
Papers and detailsHow safe are AI-generated patches?
A large-scale study of security risks in LLM and agentic automated program repair on SWE-bench.
Do LLMs consider security?
When developers ask programming questions, do models notice vulnerable code and volunteer useful security guidance?
Earlier work
Human aspects of software engineering
Trust, emotions, and psycholinguistic analysis in developer communication.
Papers and detailsInterpersonal trust in OSS
An empirical study of how interpersonal trust appears in GitHub pull request discussions.
Emotions in developer conversations
A study of emotions in developer chats, with a manually annotated dataset.
Psycholinguistic analysis in SE
A systematic mapping study of psycholinguistic text analysis in software engineering.