diff --git a/rdagent/scenarios/rl/autorl_bench/requirements.txt b/rdagent/scenarios/rl/autorl_bench/requirements.txt
index a2e127b4..fd1e111f 100644
--- a/rdagent/scenarios/rl/autorl_bench/requirements.txt
+++ b/rdagent/scenarios/rl/autorl_bench/requirements.txt
@@ -23,7 +23,7 @@ pydantic>=2.4.0  # Security fix: CVE-2024-3772 (ReDoS via crafted email)
 
 # Models
 torch>=2.6.0  # Security fix: CVE-2025-32434 (torch.load RCE with weights_only=True)
-transformers>=4.51.0  # Security fix: CVE-2024-11393 (Deserialization RCE) + CVE-2025-3264 (ReDoS)
+transformers>=4.51.0  # Security fix: CVE-2024-11393 (Deserialization RCE), CVE-2025-3264 (ReDoS), CVE-2025-2099 (ReDoS in preprocess_string)
 huggingface_hub>=0.20.0
 
 # Web services