Open research questions in Security and Verification in Computing

What the literature leaves open

• It is an open question whether such defenses can be made robust to the diversity of meltdown behaviors documented in this paper. Separately, our error scenarios are currently limited to a fixed set of individual error conditions, leaving compounded and dynamically generated errors largely unexamined.

  Agent Meltdowns: The Road to Hell Is Paved with Helpful Agents · 2026

• Hallucinations can lead the framework into unproductive analysis paths. The need for a unified approach to decision-making, tool use, and reasoning. The challenge of identifying valid security vulnerabilities in RTL code.

  MARVEL: Multi-Agent RTL Vulnerability Extraction using Large Language Models · 2026 · DOI

• studying prompt optimization, - exploring the use of different LLMs and their impact on MARVEL's performance, - investigating the application of MARVEL to other domains

  MARVEL: Multi-Agent RTL Vulnerability Extraction using Large Language Models · 2026 · DOI

• None of these studies evaluate event-driven architectures as a design pattern for coordinating threat detection, decision-making, and remediation across distributed security components. While prior work addresses autonomous remediation and adaptive threat response, no paper explicitly models or tests event-driven communication patterns (publish-subscribe, event streaming, asynchronous messaging) as the architectural substrate for closing the detection-to-execution gap in cybersecurity systems.

  Autonomous Threat Remediation in Localized AI Environments: A Review of Security-as-Code Execution Models · 2026 · DOI

• No paper models how event-driven architectures handle the temporal and causal ordering of security events during cascading or domino-effect attacks. While one study characterizes threat transmission patterns and domino effects in informatization architectures, it does not address how event-driven systems should order, buffer, or replay events to maintain consistency and traceability across distributed detection and response nodes.

  The RipA Model: On the Domino Effect in Attacks against Informatization Architectures · 2026 · DOI

• Finally, we highlight the trade-offs between security and system performance, and we outline open challenges like building low-overhead intrusion detection and creating realistic test datasets.

  From Hypervisor to Container: Cloud Security Vulnerabilities, Defense Mechanisms, and Open Challenges · 2026

• High false positive rates and high false negative rates in detecting memory corruption vulnerabilities. Low efficiency in detecting such vulnerabilities, particularly under complex calling relationships. The need for systematic analysis and characterization of memory corruption vulnerabilities in SGX projects.

  ParaTaintGX: Detecting Memory Corruption Vulnerabilities in SGX Applications via Parameter-Taint Model · 2026 · DOI

• improving the efficiency of call-chain exploration strategies, - enhancing the precision of vulnerability detection, - exploring new attack surfaces in SGX applications

  ParaTaintGX: Detecting Memory Corruption Vulnerabilities in SGX Applications via Parameter-Taint Model · 2026 · DOI

• The need for a structured self-healing abstraction layer in Linux systems. The lack of a secure and safe conversational assistance module in existing Linux systems.

  VoXlinux: A Voice-Driven Linux Operating System for Secure and Hands-Free Operation · 2026 · DOI

• The current intent-driven architecture operates within a predefined intent scope; the paper identifies integration of adaptive inference models as a future path but does not specify what machine learning model architectures (transformer-based NLU, recurrent networks, etc.) will replace the rigid parsing and routing layers or how incremental intent addition will be validated without operational disruption.

  VoXlinux: A Voice-Driven Linux Operating System for Secure and Hands-Free Operation · 2026 · DOI

• Agentic AI systems introduce new and underexplored class of privacy risks. Memory-induced data leakage is a serious concern due to its permanence and autonomous reuse. Planning and reasoning-based leakage can disclose sensitive user intent, business logic, or strategic decision-making processes.

  The dark side of autonomous intelligence: a survey on data leakage and privacy failures in agentic AI · 2026 · DOI

• The privacy implications of agentic AI systems are insufficiently understood. Existing research focuses on stateless or single-inference models, leaving a gap in the understanding of agentic AI systems. A comprehensive architectural analysis framework is needed to identify leakage pathways in agentic AI systems.

  The dark side of autonomous intelligence: a survey on data leakage and privacy failures in agentic AI · 2026 · DOI

• Generalize the DHR architecture based on three core properties (indistinguishability, output recoverability, verification) - Classify ESS into three types with corresponding DHR variants

  NEF-DHR: A Non-Equivalent Functional Dynamic Heterogeneous Redundancy Architecture for Endogenous Safety and Security · 2026 · DOI

• The inherent contradiction between functional equivalence and heterogeneous implementations. The severe terminal executor output information entropy loss in traditional EF-DHR systems. The lack of a comprehensive framework for endogenous safety and security.

  NEF-DHR: A Non-Equivalent Functional Dynamic Heterogeneous Redundancy Architecture for Endogenous Safety and Security · 2026 · DOI

• The gap between the adoption of Zero Trust principles and the actual prevention of lateral movement. The need for a framework that can identify plausible lateral-movement routes and generate useful remediation outputs.

  Evolutionary Computation-Enhanced White-Box Penetration Testing for Lateral-Movement Prevention in Zero-Trust Architectures · 2026 · DOI

• trend and show exploitation, pivoting, and goal-reaching strategies in simulated or emulated environments [1-8]. Moreno et al. critically review that this reinforcement learning and recommender systems are already being used to support autonomy in penetration testing, although remain important regarding generalization, environment realism, and reward design. Wang et al. argue for a unified modeling framework for automated penetration testing, noting that the current diversity of simulators and abstractions still hinders reproducibility and meaningful comparison. Chen et al., in their survey on penetration-path planning, show that the problem is inherently combinatorial and therefore compatible with heuristics, metaheuristics, and hybrid search strategies. Together, these studies suggest that complex security environments require mechanisms able local to combine global exploration with adaptation [1-4]. graphs, relations, The framework proposed here is positioned exactly at that intersection. It is white-box because it assumes authorized defensive access to the environment’s identity and internal blueprint: ZTNA policies, privilege historical trust authentication telemetry, continuous-verification logs, and workload dependencies. This assumption should be stated explicitly to avoid ambiguity. The goal is not to emulate a fully blind attacker, but to evaluate how a sufficiently informed adversary could exploit permission combinations, authentication pathways, and operational exceptions in order to move laterally. In Zero-Trust is environments, methodologically coherent because risk often arises not from one catastrophic vulnerability, but from the aggregation of minor policy deviations, excessive privileges, or residual connectivity across segments [12-14]. stance this 11,12–14]. Each evolutionary individual 𝜋 encodes a candidate lateral-movement path 𝑎1 𝜋 = (𝑣0 → 𝑎2 𝑣1 → 𝑎𝑘 ⋯ → 𝑣𝑘), where 𝑣𝑖 are assets or identities and 𝑎𝑖 are transitions via credentials or services [4,15]. The multi-objective fitness is defined as 𝑓(𝜋) = 𝑤1𝑃success(𝜋) + 𝑤2𝑆stealth(𝜋) + 𝑤3𝐸evasion(𝜋), with components estimated from logs and policy preconditions [9–11,16]. Reinforcement learning then locally refines promising paths [5–8]. Operationally, each individual in the population may encode a candidate chain of transitions involving assets, identities, credentials, tokens, policies, and services. Selection preserves better-performing sequences according to the fitness function; mutation introduces non-trivial alternatives; and recombination enables new compositions between promising subpaths.

  Evolutionary Computation-Enhanced White-Box Penetration Testing for Lateral-Movement Prevention in Zero-Trust Architectures · 2026 · DOI

• Empirical validation on production AMD SEV-SNP hardware - Extension of EHV to other domains and applications

  Ethical Hyper-Velocity (EHV): A Provably Deterministic Governance-Aware JIT Compiler Architecture for Agentic Systems · 2026

• Lack of mechanistic, hardware-rooted enforcement for high-frequency policy updates in autonomous agentic systems - Existing standards introduce 14-30 day latencies

  Ethical Hyper-Velocity (EHV): A Provably Deterministic Governance-Aware JIT Compiler Architecture for Agentic Systems · 2026

• Additional defended runs across all backbones. Evaluation of the defense across a broader range of attack surfaces and malicious goals. Investigation of other potential vulnerabilities in AI agents.

  LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injectio · 2026

• Limited systematic evidence across a broad range of attack surfaces, malicious goals, and LLM backbones. Lack of a benchmark for IPI risk in a production-like environment.

  LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injectio · 2026

• The problem of completion in multi-agent systems is not well-studied. Prior work is less explicit about completion authority, the handling of blocked states, and the record of stale context or rollback.

  Verify-Gated Completion as Admission Control in a Governed Multi-Agent Runtime: A Bounded Architecture Case Study · 2026

• There is a need for computable metrics through rigorous testing to determine the applicability of the system to the task. Current ethical embodied AI frameworks are mostly qualitative and do not provide measurable, objective, computable metrics.

  REBAR: Reference Ethical Benchmark for Autonomy Readiness · 2026

• Extending OVEREAGER-GEN with LLM-judge augmentation for non-shell sinks and non-enumerable authorization boundaries. Improving the benchmark to handle more complex scenarios and coding agents. Using the benchmark to evaluate and improve the behavior of coding agents.

  Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks · 2026

• There is a lack of benchmarks for measuring overeager behavior in coding agents. The existing benchmarks do not provide construction-time validity and generalization across coding agents and base models. The paper aims to fill this gap by presenting OverEager-Gen.

  Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks · 2026

• Non-deterministic reasoning and closed-loop execution in LLM agents. Non-i.i.d. traces introducing non-stationarity. The need for compositional system-level safety bounds.

  Position: A Three-Layer Probabilistic Assume-Guarantee Architecture Is Structurally Required for Safe LLM Agent Deployment · 2026

Most-cited papers in Security and Verification in Computing

• A note on the confinement problem · Communications of the ACM · 1973 · 999 citations
• Protection in operating systems · Communications of the ACM · 1976 · 689 citations
• Reflections on trusting trust · Communications of the ACM · 1984 · 410 citations
• Making components contract aware · Computer · 1999 · 298 citations
• Spectre attacks · Communications of the ACM · 2020 · 240 citations
• Self-adaptive software needs quantitative verification at runtime · Communications of the ACM · 2012 · 215 citations
• Operating system protection through program evolution · Computers & Security · 1993 · 188 citations
• Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions · ACM Transactions on Software Engineering and Methodology · 2026 · 171 citations
• Building the IBM 4758 secure coprocessor · Computer · 2001 · 168 citations
• SoK: Taxonomy of Attacks on Open-Source Software Supply Chains · 2023 · 159 citations

Most recent work

• Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions · ACM Transactions on Software Engineering and Methodology · 2026
• Tool-Entropy Collapse: A Cross-Architecture Signature of Agent WANDERING Failure · Open MIND · 2026
• SAFE-Matter™ Runtime Admissibility and Trust Governance Specification Deterministic Runtime State Governance, Trust Computation, and Execution Authority for Life-Critical Systems · Zenodo (CERN European Organization for Nuclear Research) · 2026
• SAFE-Matter™ Reference Runtime Architecture A Deployable Architecture for Admissibility, Evidence Processing, Trust Computation, and Deterministic Enforcement · Zenodo (CERN European Organization for Nuclear Research) · 2026
• TrustTiny-HAR: Selective, Open-Set, and Calibrated Activity Recognition on Microcontrollers · IEEE Transactions on Artificial Intelligence · 2026
• A Decade of Docker Containers · Communications of the ACM · 2026
• Attacks, defenses and perspectives for the runtime security of RISC-V IoT devices: A review · Computers & Security · 2026
• FreightBox Zero: Three-Layer Agent Safety Stack — Hard Gate, Five Locks, and Kernel Receipts for AI-Operated NVOCCs (v3) · Zenodo (CERN European Organization for Nuclear Research) · 2026
• Model Context Protocol Threat Modeling and Analysis of Vulnerabilities to Prompt Injection with Tool Poisoning · Journal of Cybersecurity and Privacy · 2026
• SmarTrim: Symbolic Execution for Smart Contracts Powered by Redundant Transaction-Sequence Pruning · Proceedings of the ACM on software engineering. · 2026

Related topics in Computer Science