Security Debt in LLM Agent Applications: A Measurement Study of Vulnerabilities and Mitigation Trade-offs

Thank you for your interest in our study. 🤗

In this paper, we present a curated dataset derived from 50 top-rated agent apps. Through extensive collection efforts, we identified 221 publicly disclosed vulnerabilities affecting these apps. The dataset was finalized in April 2025.

The dataset contains the following detailed information:

• Agent App List
• Vulnerability ID
• CWE
• CVSS Score
• Severity
• CVSS Vector String
• Vulnerability Description
• Reference URLs
• Vulnerability Type
• Root Cause
• Vulnerability Location
• Developer Response
• Mitigation Time
• Mitigation Strategy
• Mitigation Effectiveness

We release this dataset to facilitate further research on the security of LLM-based agent apps. If you wish to make use of this dataset or the insights it provides in your own research, please kindly cite it as follows:

@inproceedings{shen2025secdebt,
  title={Security Debt in {LLM} Agent Applications: A Measurement Study of Vulnerabilities and Mitigation Trade-offs},
  author={Shen, Zhuoxiang and Dai, Jiarun and Zhang, Yuan and Yang, Min},
  booktitle={40th {IEEE/ACM} International Conference on Automated Software Engineering},
  year={2025},
  address={Seoul, Republic of Korea}
}