612 papers on LLMs in cybersecurity, sorted by paranoia level

What it does

This repository is the companion to a systematic literature review published in Cybersecurity (SpringerOpen, 2025). It catalogs 612+ academic papers on applying large language models to cybersecurity, organized into eleven categories across three research questions: building domain-specific LLMs, using them for offense or defense, and future directions like autonomous agents.

The interesting bit

The maintainers annotate each category with trend labels — “Growing,” “Hot,” “Stable,” “Unmaintained” — which turns a bibliography into a crude but useful market-intelligence dashboard. The “LLM Assisted Attack” category is marked 🔥 Hot, which either says something about the research community or about the ease of publishing red-team papers.

Key highlights

• Defense still outnumbers offense, barely: 113 defense papers versus 83 attack papers, with vulnerability detection (94) sitting between them as the largest single category.
• Agent4Cybersecurity is the only “Emerging” category — 56 papers suggesting the field is pivoting toward autonomous systems.
• Actively maintained: updated through January 2026, with venue information added for each paper since January 2025.
• Insecure code generation research is labeled “Unmaintained” — a rare honest admission that a subfield may have stalled or been abandoned.
• Full bibliography lives in LITERATURES.md, split out from the README for readability.

Caveats

• The “trend” labels are editorial judgments with no disclosed methodology — useful heuristic, not data.
• The 612+ count includes papers through January 2026, but the systematic review itself was published in 2025; the repo has outpaced the peer-reviewed paper.

Verdict

Researchers entering the LLM×security space should bookmark this before repeating someone else’s literature review. Practitioners looking for ready-to-use tools will find only pointers to papers — this is a map, not a toolbox.