What question did this study set out to answer?

The aim is to develop a comprehensive assessment framework for identifying application security vulnerabilities exacerbated by AI techniques.

June 20, 2026Open Access

From Code to Compromise: A Unified Framework for Application Security Vulnerability Assessment in the Age of AI-Augmented Attacks

Key Points

The aim is to develop a comprehensive assessment framework for identifying application security vulnerabilities exacerbated by AI techniques.
Integrated static code analysis with dynamic web application testing.
Conducted controlled exploit-chain simulations using Boot2Root environments.
Analyzed empirical data from three B2R machines and a phishing simulation with 200 participants.
94.3% of attack chains involved at least two compounding vulnerability classes.
Organizations without structured methods faced a 3.7 times higher risk exposure.
The multi-tool static analysis pipeline identified 75% more unique findings than single tools.

Abstract

The convergence of traditional application vulnerabilities with AI-augmentedattack techniques represents one of the most significant threat escalationsof the current decade. This paper presents a Unified Application SecurityAssessment Framework (UASAF) that integrates static code analysis, dynamicweb application testing, controlled exploit-chain simulation via Boot2Root (B2R) Capture-the-Flag (CTF) environments, and phishing-vector analysis. Drawing on empirical data collected across three purpose-built B2Rassessment machines---ORACLE (medium), PHANTOM (hard), and ECHO (easy) ---real-world static analysis of the SentinelSight network monitoringapplication, and a structured phishing simulation spanning 200 simulatedparticipants, we demonstrate quantifiable patterns in how vulnerabilitiescompound across application layers. Our framework introduces afive-dimensional assessment model encompassing code-level weaknesses, configuration drift, credential exposure, social engineering susceptibility, and AI-amplified threat vectors. Results indicate that 94. 3\% of exploitableattack chains involved at least two compounding vulnerability classes, andthat organizations lacking structured assessment methodologies face a3. 7 higher projected risk exposure. The combined multi-tool staticanalysis pipeline detected 75\% more unique findings than any single tool. This research provides practitioners and academics with a reproducible, vendor-neutral methodology supported by structured CTF-based validationthat bridges theoretical vulnerability knowledge and real-world exploitationscenarios.

From Code to Compromise: A Unified Framework for Application Security Vulnerability Assessment in the Age of AI-Augmented Attacks

Key Points

Abstract

Cite This Study