Sign In

Do Coding Agents Understand Least-Privilege Authorization?

์ž‘์„ฑ์ž
  • Haebom
์นดํ…Œ๊ณ ๋ฆฌ
Empty

์ €์ž

Zheng Yan, Jingxiang Weng, Charles Chen, Dengyun Peng, Ethan Qin, Jiannan Guan, Jinhao Liu, Qiming Yu, Yixin Yuan, Fanqing Meng, Carl Che, Mengkang Hu

๐Ÿ’ก ๊ฐœ์š”

์ฝ”๋”ฉ ์—์ด์ „ํŠธ์˜ ์•ˆ์ „ํ•œ ๋ฐฐํฌ๋ฅผ ์œ„ํ•ด ์ตœ์†Œ ๊ถŒํ•œ ๋ถ€์—ฌ๋Š” ํ•„์ˆ˜์ ์ด์ง€๋งŒ, ํ˜„์žฌ ์ฝ”๋”ฉ ์—์ด์ „ํŠธ๋Š” ์ž‘์—… ์ง€์นจ๊ณผ ํ„ฐ๋ฏธ๋„ ํ™˜๊ฒฝ์„ ๋ฐ”ํƒ•์œผ๋กœ ํŒŒ์ผ ์ˆ˜์ค€์˜ ์ฝ๊ธฐ/์“ฐ๊ธฐ/์‹คํ–‰ ์ •์ฑ…์„ ์ถ”๋ก ํ•˜๋Š” ๋ฐ ์–ด๋ ค์›€์„ ๊ฒช๊ณ  ์žˆ์Šต๋‹ˆ๋‹ค. ์ €์ž๋“ค์€ ์ด๋Ÿฌํ•œ ๋ฌธ์ œ๋ฅผ ํ•ด๊ฒฐํ•˜๊ธฐ ์œ„ํ•ด "๊ถŒํ•œ ๊ฒฝ๊ณ„ ์ถ”๋ก " ๋ฐฉ๋ฒ•์„ ์ œ์•ˆํ•˜๊ณ , 120๊ฐœ์˜ ํ˜„์‹ค์ ์ธ ํ„ฐ๋ฏธ๋„ ์ž‘์—…์„ ํฌํ•จํ•˜๋Š” "AuthBench"๋ผ๋Š” ๋ฒค์น˜๋งˆํฌ๋ฅผ ๊ฐœ๋ฐœํ–ˆ์Šต๋‹ˆ๋‹ค. AuthBench์˜ ๊ฒฐ๊ณผ, ์ตœ์‹  ๋ชจ๋ธ๋“ค์€ ํ•„์š”ํ•œ ๊ถŒํ•œ์„ ๋ˆ„๋ฝํ•˜๊ฑฐ๋‚˜ ๋ถˆํ•„์š”ํ•˜๊ณ  ๋ฏผ๊ฐํ•œ ์ ‘๊ทผ ๊ถŒํ•œ์„ ๋ถ€์—ฌํ•˜๋Š” ๊ฒฝํ–ฅ์„ ๋ณด์˜€์œผ๋ฉฐ, ์ถ”๋ก  ์‹œ๊ฐ„ ์ฆ๊ฐ€๋„ ์ด ๋ฌธ์ œ๋ฅผ ํ•ด๊ฒฐํ•˜์ง€ ๋ชปํ–ˆ์Šต๋‹ˆ๋‹ค.

๐Ÿ”‘ ์‹œ์‚ฌ์  ๋ฐ ํ•œ๊ณ„

โ€ข
์ฝ”๋”ฉ ์—์ด์ „ํŠธ๊ฐ€ ์ตœ์†Œ ๊ถŒํ•œ ๋ถ€์—ฌ ์ •์ฑ…์„ ์Šค์Šค๋กœ ์ถ”๋ก ํ•˜๋Š” ๋Šฅ๋ ฅ์€ ์•„์ง ๋ถ€์กฑํ•˜๋ฉฐ, ๋‹จ์ˆœํ•œ ๋ณด์ˆ˜์ /ํ—ˆ์šฉ์  ์ •์ฑ… ์„ค์ • ๋ฌธ์ œ๊ฐ€ ์•„๋‹™๋‹ˆ๋‹ค.
โ€ข
๊ธฐ์กด ๋ชจ๋ธ๋“ค์€ ์ž‘์—… ์‹คํ–‰์— ํ•„์š”ํ•œ ๊ถŒํ•œ๊ณผ ๋ถˆํ•„์š”ํ•˜๊ฑฐ๋‚˜ ๋ฏผ๊ฐํ•œ ๊ถŒํ•œ์„ ๋™์‹œ์— ๋ถ€์—ฌํ•˜๋Š” ์ด์ค‘์ ์ธ ์‹คํŒจ ๋ชจ๋“œ๋ฅผ ๋ณด์ด๋ฉฐ, ์ถ”๋ก  ๋Šฅ๋ ฅ ํ–ฅ์ƒ๋งŒ์œผ๋กœ๋Š” ํ•ด๊ฒฐ๋˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค.
โ€ข
์ œ์•ˆ๋œ "Sufficiency-Tightness Decomposition" ๋ฐฉ๋ฒ•๋ก ์€ ์ž‘์—… ์‹คํ–‰์„ ์ˆœ๋ฐฉํ–ฅ ์‹œ๋ฎฌ๋ ˆ์ด์…˜ํ•˜์—ฌ ํ•„์š”ํ•œ ๊ถŒํ•œ์„ ๋จผ์ € ํ™•๋ณดํ•˜๊ณ , ์ดํ›„ ๊ฐ ๊ถŒํ•œ์˜ ๊ทผ๊ฑฐ์™€ ๋ฏผ๊ฐ๋„๋ฅผ ๊ฐ์‚ฌํ•˜๋Š” ๋ฐฉ์‹์œผ๋กœ ๋ฏผ๊ฐ ์ž‘์—… ์„ฑ๊ณต๋ฅ ์„ ์ตœ๋Œ€ 15.8% ํ–ฅ์ƒ์‹œํ‚ค๊ณ  ๊ณต๊ฒฉ ์„ฑ๊ณต๋ฅ ์„ ๊ฐ์†Œ์‹œํ‚ค๋Š” ํšจ๊ณผ๋ฅผ ๋ณด์˜€์Šต๋‹ˆ๋‹ค.
โ€ข
์ง์ ‘์ ์ธ ์ •์ฑ… ์ƒ์„ฑ ๋ฐฉ์‹์ด ํ•„์ˆ˜์  ์ ‘๊ทผ ๊ถŒํ•œ ๋ฐœ๊ฒฌ๊ณผ ๋ถˆํ•„์š”ํ•œ ๊ถŒํ•œ ๊ฑฐ๋ถ€๋ฅผ ๋™์‹œ์— ์ˆ˜ํ–‰ํ•ด์•ผ ํ•˜๋ฏ€๋กœ ๋ณ‘๋ชฉ ํ˜„์ƒ์„ ์•ผ๊ธฐํ•ฉ๋‹ˆ๋‹ค.
๐Ÿ‘
Made with Slashpage