Research OS / 2026

I build and evaluate AI agents for cybersecurity.

Hwiwon Lee

PhD student in Computer Science at UIUC · advised by Prof. Lingming Zhang

Portrait of Hwiwon Lee

Research taxonomy

Three vectors,
one objective.

I connect agent evaluation, systems evidence, and applied vulnerability research to make security automation measurable and useful.

V01

Agentic security

Autonomous agents for realistic, long-horizon security engineering workflows.

V02

Software systems

Reasoning grounded in program analysis, dynamic execution, and reproducible evidence.

V03

Vulnerability research

Discovery and validation across production software, services, and commercial binaries.

Validated vulnerabilities

344

Browser engines and Linux kernel tasks in SEC-bench Pro

Workflow horizon

Long

From bug discovery through debugger-verified validation

Latest signals

Recent news

  1. SEC-bench Pro, our benchmark for long-horizon software security tasks, is now available on arXiv.

  2. Agentic Vulnerability Reasoning on COTS Binaries is now available on arXiv.

  3. Recognized as a Microsoft Most Valuable Security Researcher for 2026 Q1.

Evidence base / Selected

Publications

Authoritative work on security-agent evaluation, autonomous vulnerability reasoning, and practical root-cause analysis.

  1. arXiv · 2026

    PDF of SEC-bench Pro

    SEC-bench Pro: Can Language Models Solve Long-Horizon Software Security Tasks?

    Hwiwon Lee, Jiawei Liu, Dongjun Kim, Wubing Xia, Ziqi Zhang, Chunqiu Steven Xia, Lingming Zhang

    A benchmark of 344 validated vulnerabilities across browser engines and the Linux kernel, designed to measure realistic agent bug hunting.

  2. arXiv · 2026

    PDF of Agentic Vulnerability Reasoning on COTS Binaries

    Agentic Vulnerability Reasoning on COTS Binaries

    Hwiwon Lee, Jongseong Kim, Lingming Zhang

    An end-to-end study of autonomous vulnerability discovery and debugger-verified validation on commercial Windows binaries.

  3. NeurIPS · 2025

    PDF of SEC-bench

    SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks

    Hwiwon Lee, Ziqi Zhang, Hanxiao Lu, Lingming Zhang

    A fully automated framework for constructing and evaluating authentic proof-of-concept generation and vulnerability patching tasks.

  4. IEEE S&P · 2024

    PDF of BENZENE

    BENZENE: A Practical Root Cause Analysis System with an Under-Constrained State Mutation

    Younggi Park, Hwiwon Lee, Jinho Jung, Kevin Koo, Huy Kang · Distinguished Paper

    A practical, automated crash-diagnosis system that uses under-constrained state mutation to rank root causes efficiently.