[Preprint] Heimdallr: Characterizing and Detecting LLM-Induced Security Risks in GitHub CI Workflows
Bonan Ruan, Yeqi Fu, Chuqi Zhang, Jiahao Liu, Jun Zeng, Zhenkai Liang
arXiv 2026
Bonan Ruan 阮博男
Ph.D. Candidate
School of Computing National University of Singapore
E-mail: bonan.ruan@u.nus.edu Scholar: Google Scholar GitHub | CV | Blog
School of Computing National University of Singapore
E-mail: bonan.ruan@u.nus.edu Scholar: Google Scholar GitHub | CV | Blog
Bonan Ruan (阮博男) is a Ph.D. candidate at the School of Computing, National University of Singapore (NUS), advised by Prof. Zhenkai Liang. His research focuses on securing LLM-based agents operating in real-world software ecosystems. He studies how security risks emerge and propagate through agent interactions with tools, skills, workflows, and other external components, and develops practical techniques to characterize, assess, detect, and mitigate these risks. His research builds on a broader background in systems security, software supply chain security, vulnerability analysis, and program analysis.
Before beginning his graduate studies, he worked as a security researcher at NSFOCUS, where he researched cloud-native security, helped incubate new security products, and co-authored the book Cloud Native Security: Practice and Architecture. His research has appeared at ASE, USENIX Security, ICLR, and RAID, and has received the Best Practical Paper Award at RAID and a Distinguished Paper Award at USENIX Security.
He has presented his work at Black Hat Asia, KCon, CIS, and OpenInfra Days Asia. He created Metarget, an open-source framework for constructing vulnerable cloud-native infrastructures; the project has received 1.4K+ GitHub stars, is listed in the CNCF Cloud Native Landscape, and is used in industry.
News
- Jan 2026Our work on benchmarking AI agents in DevOps (DevOps-Gym) was accepted to ICLR 2026!
- Dec 2025I received the Research Achievement Award from the NUS School of Computing!
- Nov 2025Gossip published a feature on VPSS.
- Nov 2025I served on the USENIX Security 2026 Artifact Evaluation Committee (AEC).
- Sep 2025Our work on vulnerability assessment for software supply chains (VPSS) was accepted to ASE 2025!
- Aug 2025The NUS School of Computing featured FlowFusion on its website.
- Aug 2025FlowFusion won the Distinguished Paper Award at USENIX Security 2025!
- Aug 2025Our MCP dataset (MCPCorpus) was accepted to ASE 2025 Tool Demonstrations!
- Jun 2025I passed my qualifying exam and became a Ph.D. candidate!
- Apr 2025KernJC was presented at Black Hat Asia 2025!
- Jan 2025Our work on PHP fuzzing (FlowFusion) was accepted to USENIX Security 2025!
- Oct 2024Articles featuring KernJC were published by Gossip and the NUS School of Computing.
- Oct 2024KernJC won the Best Practical Paper Award at RAID 2024!
- Aug 2024Our vulnerability intelligence dataset (VulZoo) was accepted to ASE 2024 Tool Demonstrations!
- Jun 2024Our work on kernel vulnerability reproduction (KernJC) was accepted to RAID 2024!
- Jan 2024Started my Ph.D. at NUS!
Selected Publications
[ICLR 2026] DevOps-Gym: Benchmarking AI Agents in Software DevOps Cycle
Yuheng Tang*, Kaijie Zhu*, Bonan Ruan, Chuqi Zhang, Michael Yang, Hongwei Li, Suyue Guo, Tianneng Shi, Zekun Li, Christopher Kruegel, Giovanni Vigna, Dawn Song, William Yang Wang, Lun Wang, Yangruibo Ding, Zhenkai Liang, Wenbo Guo
14th International Conference on Learning Representations
[ASE 2025] Propagation-Based Vulnerability Impact Assessment for Software Supply Chains
Bonan Ruan, Zhiwei Lin, Jiahao Liu, Chuqi Zhang, Kaihang Ji, Zhenkai Liang
40th IEEE/ACM International Conference on Automated Software Engineering
[USENIX Security 2025] Fuzzing the PHP Interpreter via Dataflow Fusion
Yuancheng Jiang, Chuqi Zhang, Bonan Ruan, Jiahao Liu, Manuel Rigger, Roland Yap, Zhenkai Liang
34th USENIX Security Symposium
Distinguished Paper Award
[RAID 2024] KernJC: Automated Vulnerable Environment Generation for Linux Kernel Vulnerabilities
Bonan Ruan, Jiahao Liu, Chuqi Zhang, Zhenkai Liang
27th International Symposium on Research in Attacks, Intrusions and Defenses
Best Practical Paper Award · Black Hat Asia 2025 Briefings
Education
Jan. 2024 – present, Ph.D. Candidate, School of Computing, National University of Singapore
Jul. 2022 – Dec. 2023, Master of Computing, National University of Singapore
Sep. 2014 – Jul. 2019, B.E. in Information Security, including one year of intensive German study, Tongji University
Work Experience
Sep. 2022 – Apr. 2023, Research Intern, National Cybersecurity R&D Lab, Singapore
Jul. 2019 – Jun. 2022, Security Researcher, NSFOCUS, Beijing/Nanjing, China
Jul. 2017 – Aug. 2017, Software Development Engineer Intern, Huawei Technologies, Shanghai, China
Honors & Awards
- Research Achievement Award, School of Computing, NUS2025
- Distinguished Paper Award, USENIX Security2025
- Best Practical Paper Award, RAID2024