Week Ending 7.19.2026

2026-07-20 · Source: Research Watch - Eye On AI · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Advanced, extended

Summary

Connected and Autonomous Vehicles (CAVs) face vulnerabilities often buried in unstructured CVE text. This paper evaluates 11 open-weight LLMs (4B to 120B parameters) for converting CAV vulnerability descriptions into structured STIX threat objects, CWE weaknesses, and MITRE ATT&CK mappings, using the new CAV-STIXGen dataset. Single-model configurations achieved F1 scores of 0.94 for STIX Domain Objects (SDO), 0.63 for STIX Relationship Objects (SRO), and 0.99 for CWE mapping. Complete MITRE ATT&CK mapping remained challenging. Multi-agent setups, like Gemma-4-31B and Codestral-22B, achieved F1 scores of 0.91 for SDOs and 0.43 for SROs.

Key takeaway

For AI Security Engineers managing Connected and Autonomous Vehicle vulnerabilities, consider integrating open-weight LLMs to automate the conversion of unstructured CVEs into STIX, CWE, and MITRE ATT&CK formats. This can streamline threat intelligence and prioritize defense strategies, though full attack chain mapping still requires human oversight for accuracy.

Key insights

LLMs can structure CAV vulnerability data, but struggle with full attack chains.

Principles

• Open-weight LLMs achieve high F1 for SDO (0.94) and CWE (0.99) mapping.
• Multi-agent LLMs like Gemma-4-31B perform well on SDOs (0.91 F1).

Method

Evaluate 11 open-weight LLMs on CAV-STIXGen dataset, mapping CAV vulnerability descriptions to STIX, CWE, and MITRE ATT&CK.

In practice

• Automate threat intelligence pipelines for transportation security.
• Prioritize patching and defense strategies for CAVs.

Topics

• Autonomous Vehicles
• Cybersecurity
• Threat Intelligence
• Large Language Models
• STIX
• MITRE ATT&CK
• Vulnerability Management

Code references

• hanyang-chen/DADiff-release
• AGI4Sci/SciForge

Best for: NLP Engineer, Research Scientist, AI Scientist, AI Security Engineer, Robotics Engineer

Related on AIssential

• Evaluating Open-Weight LLMs for Generating Structured Threat Information for Autonomous Vehicle Vulnerabilities — Open-weight LLMs can automate structured threat intelligence generation for CAV vulnerabilities, though MITRE ATT&CK mapping remains difficult.
• An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports — An automated framework uses LLMs to model CTI report attack steps with pre/postconditions for automated reachability analysis.
• Building an Agentic Security Pipeline That Finds, Proves, and Patches Vulnerabilities — LLM-powered agentic pipelines can automate finding, proving, and patching vulnerabilities in complex codebases.
• The Emergence of Autonomous Penetration Capabilities in Large Language Model-Powered AI Systems — LLM-powered AI systems exhibit autonomous penetration capabilities, with success rates up to 69.3% in realistic evaluations, improving with model advancement.
• Sifting the Noise: A Comparative Study of LLM Agents in Vulnerability False Positive Filtering — LLM agents significantly reduce SAST false positives, but effectiveness is highly dependent on the backbone model and vulnerability category.
• How I Turned AI to the Dark Side — LLM safety mechanisms are systemically vulnerable to manipulation, allowing extraction of dangerous information across major models.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Research Watch - Eye On AI.