diff --git a/rdagent/scenarios/rl/autorl_bench/requirements.txt b/rdagent/scenarios/rl/autorl_bench/requirements.txt
index 08a2ecdb..3fb21d28 100644
--- a/rdagent/scenarios/rl/autorl_bench/requirements.txt
+++ b/rdagent/scenarios/rl/autorl_bench/requirements.txt
@@ -9,7 +9,7 @@ peft>=0.18.1
 
 # Evaluation
 opencompass==0.5.1
-setuptools<75  # uv venv doesn't include, opencompass depends on pkg_resources
+setuptools>=78.1.1  # Security fix: GHSA-8g6x-3r52-4m6c (path traversal in PackageIndex.download, arbitrary file write/RCE)
 
 # Inference acceleration (optional, TRL supports 0.10.2-0.12.0)
 # Security: Version >=0.14.0 fixes CVE-2026-22807 (RCE via auto_map dynamic module loading)