CompSec
Computer Security Lab at Seoul National University
Dept. of Electrical and Computer EngineeringBuilding 303, Room 561-1 · 서울대학교 303동 561-1호
About CompSec Lab
Our research group works on general computer security and privacy problems. In particular, our research focus is systems security or systems hacking for commodity systems—designing and implementing secure systems for operating systems (Windows, Linux, Mac OS X) and user applications (Chrome, Firefox, Apache), or identifying or exploiting new vulnerabilities in popular computing systems.
What we work on
Our group works across the computer security spectrum, with a focus on software and systems security. Our recent work spans the security of AI and LLM-based agents, hardware and microarchitectural attacks and defenses, confidential computing, automated vulnerability discovery, and OS/kernel attack and defense.
All research areas →AI Agent Security
Agent Data Injection arXiv 26
Agent Data Injection introduces a new category of indirect prompt injection in which malicious data is disguised as trusted data, enabling arbitrary click attacks on web agents and remote code execution on coding agents.
Vulnerability Finding
OZZ SOSP 24Best Paper
OZZ discovers kernel out-of-order concurrency bugs by reordering in-vivo memory accesses, exposing bugs that only manifest under weak memory ordering.
Hardware & Microarchitectural Security
GHost in the SHELL S&P 26
GHost in the SHELL is a GPU-to-host memory attack that crosses the isolation boundary between the GPU and the CPU, together with a mitigation that closes the leak.
Confidential Computing & Trusted Execution
DLBox NDSS 25
DLBox is a model-training framework that protects training data end-to-end, keeping datasets confidential even from the party running the training.
Latest Updates
We released Mandu, an open-source tool that keeps your secrets from your AI coding agent. Read the blog post.
Our preprint Agent Data Injection, an arbitrary click attack against web agents, is out on arXiv. Read the blog post.
Our preprint DualView, a defense for personal AI agents against indirect prompt injection, is out on arXiv. Read the blog post.
We disclosed Bad Epoll, a race-condition use-after-free in the Linux kernel epoll subsystem. Read the blog post.
The CompSec Blog is launched with news, research notes, and writeups from the lab.
Heap Localization is accepted to IEEE S&P 2026!
SoK: Attack and Defense Landscape of Agentic AI Systems is accepted to USENIX Security 2026!
DMGuard is accepted to USENIX Security 2026!
GHost in the SHELL is accepted to IEEE S&P 2026!
Our preprint Prompt Flow Integrity (PFI), preventing privilege escalation in LLM agents, is out on arXiv.
From the blog All posts →
- Mandu: Keeping your secrets from your AI coding agent
Mandu is an open-source tool that lets coding agents like Claude Code and Codex work next to real credentials while the AI only ever sees masked placeholders. It builds on our Prompt Flow Integrity and DualView research.
- Agent Data Injection: An arbitrary click attack against web agents
A single planted product review can make web agents like Claude for Chrome click attacker-chosen buttons. We show an XSS-like attack against web agents.
- DualView: Defending personal AI agents like OpenClaw against indirect prompt injection
We introduce DualView, a system for protecting personal AI agents like OpenClaw from immediate and stored indirect prompt injection attacks.
- Bad Epoll: The bug missed by Mythos
A race-condition use-after-free in the Linux kernel epoll subsystem that gains root on Linux, and that Anthropic's Mythos missed. More details at badepoll.com.
- Welcome to the CompSec Blog
Kicking off the CompSec Lab blog with news, research notes, and writeups.