In the face of escalating cyber threats to critical infrastructures, achieving robust cyber resilience has become paramount. This paper proposes an endogenous security-oriented framework for cyber resilience assessment, specifically tailored for critical infrastructures. Drawing on the principles of endogenous security, our framework integrates dynamic heterogeneous redundancy (DHR) and adaptive defense mechanisms to address both known and unknown threats. We model resilience across four key dimensions—Prevention, Destruction Resistance, Adaptive Recovery, and Evolutionary Learning—using a novel mathematical formulation that captures nonlinear interactions and temporal dynamics. The framework incorporates environmental threat entropy to dynamically adjust resilience scores, ensuring relevance in evolving attack landscapes. Through empirical validation on simulated critical infrastructure scenarios, we demonstrate the framework’s ability to quantify resilience trajectories and trigger timely defensive adaptations. Empiricalvalidation on a real-world critical infrastructure system yielded an overall resilience score of 82.75, revealing a critical imbalance between strong preventive capabilities (90/100) and weak Adaptive Recovery (66/100). Our approach offers a significant advancement over static risk assessment models by providing actionable metrics for strategic resilience investments. This work contributes to the field by bridging endogenous security theory with practical resilience engineering, paving the way for more robust protection of critical systems against sophisticated cyber threats.

Coding agents powered by large language models are becoming central modules of modern IDEs. They help users to perform various complex coding tasks by invoking tools. Although powerful, tool-invocation operation in coding agents opens a substantial attack surface for adversaries. Prior work has demonstrated attacks against both general-purpose LLM agents and domain-specific agents. However, to our knowledge, no previous works focus on the security risks of tool-invocation in coding agents. To fill this gap, we conduct the first systematic, in-depth red-teaming from a tool-invocation perspective in six popular real-world coding agents: Cursor, Claude Code, Copilot, Windsurf, Cline, and Trae. Our red-teaming proceeds in two phases. In Phase 1, we conduct a prompt leakage as reconnaissance to recover system prompts and related context. Specifically, we identify a mode gap between chat generation and tool-call argument generation: during schema-driven argument completion, the model behaves as if it is performing benign structured filling and may copy hidden agent context into tool-call arguments. We instantiate this gap as ToolLeak, which exfiltrates agent-internal prompts (e.g., system prompts and tool metadata) via required tool parameters. In Phase 2, we hijack the tool-invocation behavior of the coding agent with a novel two-channel prompt injection in the tool description and the tool return. Our hijacking achieves remote code execution (RCE) on major real-world coding agents. We adaptively construct the malicious payload using leaked security information in Phase 1. Our evaluation shows that ToolLeak substantially outperforms strong prompt-leak baselines in both emulated and real-world settings. In the emulated setting, ToolLeak achieves the best overall prompt-exfiltration performance across all six simulated coding agents. On real-world coding agents, ToolLeak achieves the best pseudo-recall on 18 of 25 evaluated agent-LLM pairs. Furthermore, our red-teaming successfully hijacks all six real-world coding agents for RCE and consistently yields higher attack success rates than baseline attacks. Lastly, we present two case studies on Cursor and Claude Code to demonstrate the real-world impact of our red-teaming.