{"as_of":"2026-08-05T01:00:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:d5641961a8d7c0a94f8329c1c19459c78228697dd676952b16a62dd7e6476579","coverage":[{"denominator":79,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":79,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-13T06:35:13.331872Z","state":"measured"},{"denominator":175,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":175,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-04T06:34:03.388597+00:00","state":"measured"},{"denominator":96,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":96,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-04T09:25:38.687859Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-07-11T02:47:49.867984Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2502.01241","last_updated":"2026-04-13T12:56:05Z","snapshot_observed_at":"2026-07-06T20:30:12.663808Z","submitted_at":"2025-02-03T11:02:30Z","title":"Peering Behind the Shield: Guardrail Identification in Large Language Models","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-23T03:45:14.234545Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2502.01241"},"observation_digest":"sha256:551fd5b05a5cd776c6991ddc8663c804cd6aaec26867df34837d799c87d213de","observation_id":"30d05291-0f12-4cf3-b7c4-1fdde80ed998","resolution":{"observed_at":"2026-05-23T03:45:21.431564Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2510.09023","last_updated":"2025-10-10T05:51:04Z","snapshot_observed_at":"2026-08-03T03:11:42.084785Z","submitted_at":"2025-10-10T05:51:04Z","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-07-11T11:50:26.030339Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2510.09023"},"observation_digest":"sha256:f4d4250d80fae5f88e2c04effab52a24e73397fda943ce76557ea3f67d11db67","observation_id":"ed98329e-0ffe-4fa5-9d71-eb885dd125ed","resolution":{"observed_at":"2026-05-16T18:53:24.689725Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-04T09:25:38.687859Z","title":"Agentdojo: A dynamic environment to evaluate attacks and defenses for LLM agents.CoRR, abs/2406.13352, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-04T09:25:33.987336Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:38.687859Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:948a1565503301b7aa70a99077e5a31007dec5b7f7c4a4284fec01dd2e43c419","observation_id":"0a0ab53c-274f-4eea-9840-214d7c8b968b","resolution":{"observed_at":"2026-08-04T09:25:38.687859Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2510.23883","last_updated":"2026-04-03T16:27:34Z","snapshot_observed_at":"2026-08-02T13:42:34.526072Z","submitted_at":"2025-10-27T21:48:11Z","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","version":3},"reference_index":192,"source":"pdf_text","source_observed_at":"2026-05-18T03:42:10.703369Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2510.23883"},"observation_digest":"sha256:c7447393e70cc2632b3276b5fc7c8d361d1f7d8aa83e115dd5373474e99bf125","observation_id":"23a7eeec-518f-4f7a-b732-bb2272008759","resolution":{"observed_at":"2026-05-18T03:42:22.400493Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-03T14:24:20.592814Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2512.20806","last_updated":"2026-05-31T13:11:43Z","snapshot_observed_at":"2026-08-03T15:38:47.492714Z","submitted_at":"2025-12-23T22:13:14Z","title":"Safety Alignment of LMs via Non-cooperative Games","version":3},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-03T14:24:20.592814Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2512.20806"},"observation_digest":"sha256:6926c51107ee22a22d9ff9a1ecccc77ecc5bdbd990b3329b27727ef6b6c16b93","observation_id":"af809779-a57c-4792-a76c-53d8f178c1ca","resolution":{"observed_at":"2026-08-03T14:24:20.592814Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2603.14987","last_updated":"2026-05-21T06:24:06Z","snapshot_observed_at":"2026-08-03T21:30:30.993382Z","submitted_at":"2026-03-16T08:51:33Z","title":"Beyond Benchmark Islands: Toward Representative Trustworthiness Evaluation for Agentic AI","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-22T10:19:56.003219Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2603.14987"},"observation_digest":"sha256:1318593063a219e0532653abbfba48cfb0c014ef6759174858df8b88156d1fd3","observation_id":"f95c9a94-86ae-45ea-8534-980ab2ced78e","resolution":{"observed_at":"2026-05-22T10:21:23.291188Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2603.22868","last_updated":"2026-05-08T19:13:57Z","snapshot_observed_at":"2026-08-03T22:25:03.054285Z","submitted_at":"2026-03-24T07:12:53Z","title":"Agent-Sentry: Bounding LLM Agents via Execution Provenance","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-15T01:17:40.860439Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2603.22868"},"observation_digest":"sha256:d308c3c6066bd8d31ebcf76f354953e3d598da6724133aa10015f9b430c2cd73","observation_id":"9a34f3ce-b1cc-4e89-9cd2-14cc4df36301","resolution":{"observed_at":"2026-05-15T01:18:26.431574Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:8c3e4408bc606476ee4ac1537a382f8c5b99eac0b86297251ed61e27ab93c710","observation_id":"e84540e6-9de9-46d1-90cb-392d7ea970ad","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-13T11:36:41.748710Z","title":"Jingcheng Deng, Liang Pang, Zihao Wei, Shichen Xu, Zenghao Duan, Kun Xu, Yang Song, Huawei Shen, and Xueqi Cheng","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2604.04989","last_updated":"2026-04-05T06:25:11Z","snapshot_observed_at":"2026-07-13T11:36:36.354754Z","submitted_at":"2026-04-05T06:25:11Z","title":"SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-07-13T11:36:41.748710Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.04989"},"observation_digest":"sha256:761fee48cf29afd7c55517d8cdfe1af1cdebb774fe1f3f73bb4af6e0f7836846","observation_id":"46f0b412-409f-4e5f-a34d-94fe5e00d6c6","resolution":{"observed_at":"2026-07-13T11:36:41.748710Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.05872","last_updated":"2026-04-07T13:29:34Z","snapshot_observed_at":"2026-07-06T22:54:30.567988Z","submitted_at":"2026-04-07T13:29:34Z","title":"Swiss-Bench 003: Evaluating LLM Reliability and Adversarial Security for Swiss Regulatory Contexts","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-10T19:44:26.931344Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.05872"},"observation_digest":"sha256:6d52ecc5cccbcb091ddf6438d8e4d636e624e76eb0cb79340f1aa5414a46d513","observation_id":"24362374-0bbb-43a4-acc9-54681f1918d4","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.11790","last_updated":"2026-05-11T16:09:04Z","snapshot_observed_at":"2026-07-06T23:00:08.171601Z","submitted_at":"2026-04-13T17:55:11Z","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-10T16:05:47.517157Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.11790"},"observation_digest":"sha256:b9ce9658faa7ab762dc1a304e53ccd7b1badc4f9f7c8864e0070de91a9023f5a","observation_id":"dc250877-5c5e-4f0e-acd2-3e99a8242651","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.11790","last_updated":"2026-05-11T16:09:04Z","snapshot_observed_at":"2026-07-06T23:00:08.171601Z","submitted_at":"2026-04-13T17:55:11Z","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-12T04:17:07.080092Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.11790"},"observation_digest":"sha256:daf15e65a444609944785f0da19891cc4da6a869772f05c892918f1418cc41c0","observation_id":"dfae0e02-d4a6-4fdf-af68-5b8ef8d4ae1b","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.12177","last_updated":"2026-04-14T01:15:15Z","snapshot_observed_at":"2026-07-06T23:00:28.036409Z","submitted_at":"2026-04-14T01:15:15Z","title":"Policy-Invisible Violations in LLM-Based Agents","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-10T16:20:14.720123Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.12177"},"observation_digest":"sha256:20ba2bf97c20ffb7a1c786c599956c2e528e40970fcfd4625401acb39f2b97e2","observation_id":"e40f8581-2e32-4521-8b15-5c22de4f9974","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.15415","last_updated":"2026-04-16T17:31:52Z","snapshot_observed_at":"2026-07-06T23:02:58.361418Z","submitted_at":"2026-04-16T17:31:52Z","title":"HarmfulSkillBench: How Do Harmful Skills Weaponize Your Agents?","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-10T10:32:37.967401Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.15415"},"observation_digest":"sha256:0b3264ac978e2c0a64316883327bf2cb94f5537fa8426922c85e92589f02fb78","observation_id":"d0dc535a-c74e-4d9b-9c85-398cc41c4ed7","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.18248","last_updated":"2026-07-30T16:35:11Z","snapshot_observed_at":"2026-08-02T23:57:45.082199Z","submitted_at":"2026-04-20T13:27:05Z","title":"Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-10T04:42:33.450658Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.18248"},"observation_digest":"sha256:0b2ae0fa01f0b3118702d188998d57a98c418dc48052f5656ca76195a31f44a7","observation_id":"dc779b38-37e2-4cf6-99ab-44b2c25acc82","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.18248","last_updated":"2026-07-30T16:35:11Z","snapshot_observed_at":"2026-08-02T23:57:45.082199Z","submitted_at":"2026-04-20T13:27:05Z","title":"Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-21T00:51:22.907932Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.18248"},"observation_digest":"sha256:7791ca2683e8b456dae2188e38b19d1e6dbe534f8ed6a96cb2a47dba5dffca1c","observation_id":"cd8b93cb-162f-45f8-90dc-b56fa9260764","resolution":{"observed_at":"2026-05-21T00:53:53.091146Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-02T15:56:47.681500Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2604.18248","last_updated":"2026-07-30T16:35:11Z","snapshot_observed_at":"2026-08-02T23:57:45.082199Z","submitted_at":"2026-04-20T13:27:05Z","title":"Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection","version":4},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-02T15:56:47.681500Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.18248"},"observation_digest":"sha256:1117ffa47fc5be0a74c96c111ddd5edb3129c5f0896acc216630ff27923fd508","observation_id":"1c0a687c-91b6-4399-bc0f-cf50fca1128f","resolution":{"observed_at":"2026-08-02T15:56:47.681500Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.18652","last_updated":"2026-05-18T11:38:04Z","snapshot_observed_at":"2026-07-06T23:05:26.398712Z","submitted_at":"2026-04-20T05:25:37Z","title":"From Craft to Kernel: A Governance-First Execution Architecture and Semantic ISA for Agentic Computers","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-10T04:51:51.568400Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.18652"},"observation_digest":"sha256:491eb9756e7bf8395366338aa958a1497dc1fcfdc3974c4d630764b59b87c784","observation_id":"d27b412e-7742-4cb9-8757-67285e49356c","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.18652","last_updated":"2026-05-18T11:38:04Z","snapshot_observed_at":"2026-07-06T23:05:26.398712Z","submitted_at":"2026-04-20T05:25:37Z","title":"From Craft to Kernel: A Governance-First Execution Architecture and Semantic ISA for Agentic Computers","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-21T01:14:48.342176Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.18652"},"observation_digest":"sha256:fddb49c980bdf97c108d556b01511811f5ea4f11dd36d2a341b4b8da63f7eb9b","observation_id":"9440cc5a-8988-43c1-b964-b4bb45ab179f","resolution":{"observed_at":"2026-05-21T01:19:20.951421Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.19657","last_updated":"2026-04-21T16:45:30Z","snapshot_observed_at":"2026-07-06T23:06:16.972438Z","submitted_at":"2026-04-21T16:45:30Z","title":"An AI Agent Execution Environment to Safeguard User Data","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-10T02:14:40.639143Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.19657"},"observation_digest":"sha256:6ce19559748d3e984e6f091a05b15cf14101b6c554fa4a1e591ea4cabbce1fa3","observation_id":"f7c9cc1d-0c58-41d8-8c90-507f96aac854","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.20704","last_updated":"2026-04-22T15:46:11Z","snapshot_observed_at":"2026-07-06T23:07:25.185196Z","submitted_at":"2026-04-22T15:46:11Z","title":"Auto-ART: Structured Literature Synthesis and Automated Adversarial Robustness Testing","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-05-10T00:39:43.196010Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.20704"},"observation_digest":"sha256:d0e4575095a4e8d2ffa31823f3cc615081b1f69aa46d46726828ae0a68a9b48a","observation_id":"8ca8a1fc-bb43-43ab-bc10-fff860a9b826","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:5ece54cb6ab86d6d5c0b220609b26c8b9f4c89fe77c7a37159e7bdf528652701","observation_id":"942fe2a4-f747-4c9d-aa45-a1df055c4578","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.22888","last_updated":"2026-04-24T09:07:05Z","snapshot_observed_at":"2026-07-06T23:09:10.050398Z","submitted_at":"2026-04-24T09:07:05Z","title":"RouteGuard: Internal-Signal Detection of Skill Poisoning in LLM Agents","version":1},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-05-08T11:26:53.382527Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.22888"},"observation_digest":"sha256:be0356a50ffaa4e04899b2d86820a923965707999af12e74b3571501e3842c7e","observation_id":"91de15d5-2172-4825-8cf3-9540c8542154","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.23338","last_updated":"2026-05-06T17:17:02Z","snapshot_observed_at":"2026-07-06T23:09:34.300163Z","submitted_at":"2026-04-25T14:57:15Z","title":"A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework","version":2},"reference_index":141,"source":"pdf_text","source_observed_at":"2026-05-08T07:53:13.746141Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.23338"},"observation_digest":"sha256:26649f383eadf27a0547c8d6a3d52e7ad5a4a8263e4f6ef1747024f5fe430dd4","observation_id":"78e9fee3-194d-406f-80d5-f9cffbe1444c","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.00081","last_updated":"2026-04-30T14:38:05Z","snapshot_observed_at":"2026-07-06T23:13:33.799847Z","submitted_at":"2026-04-30T14:38:05Z","title":"Alignment Contracts for Agentic Security Systems","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-09T20:47:28.506174Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.00081"},"observation_digest":"sha256:fa3f8ad5ef21c8ebddb30ef0cee46670af17ba38bf276f8eb72fdf161363c360","observation_id":"bb1a6388-d31f-440b-b172-d05c4aa09739","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.00314","last_updated":"2026-05-01T00:48:47Z","snapshot_observed_at":"2026-07-06T23:13:47.082550Z","submitted_at":"2026-05-01T00:48:47Z","title":"Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesis","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-09T19:58:28.584941Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.00314"},"observation_digest":"sha256:e16498d119eaac6341afe0805636f0af12c294ebc5a40314d0e148560c6f8389","observation_id":"69c0d805-4a7a-4375-ac7d-71ddaa3a74e7","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.01970","last_updated":"2026-05-15T06:42:15Z","snapshot_observed_at":"2026-07-06T23:15:07.159340Z","submitted_at":"2026-05-03T17:07:20Z","title":"Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-09T17:13:47.722098Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.01970"},"observation_digest":"sha256:0cbab89101034132e6d80f51ef2195858d0c688e6f7f1dd15956cdcd209eeb55","observation_id":"9ecdd87d-3bbe-4287-b4b0-76fc53ceb6f2","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.02236","last_updated":"2026-05-05T08:03:21Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2026-05-04T05:16:43Z","title":"Perturbation Dose Responses in Recursive LLM Loops: Raw Switching, Stochastic Floors, and Persistent Escape under Append, Replace, and Dialog Updates","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-08T19:17:06.375875Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.02236"},"observation_digest":"sha256:efa17b88918f73de4221bfdbbff58b96da1cc46c6f7405e41436a2fa961cb6f6","observation_id":"79808040-253d-4f7f-bfab-716add888dea","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.05846","last_updated":"2026-05-07T08:21:51Z","snapshot_observed_at":"2026-08-02T22:13:21.752885Z","submitted_at":"2026-05-07T08:21:51Z","title":"LoopTrap: Termination Poisoning Attacks on LLM Agents","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-08T09:25:11.059634Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.05846"},"observation_digest":"sha256:0ea6d6173a664f142c89c60929eac4a18df27ea16d96cf6fd0c973ff09dc0fd6","observation_id":"8617504c-fc44-42fd-9bcc-b0416d57ac27","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.05868","last_updated":"2026-05-07T08:34:14Z","snapshot_observed_at":"2026-07-06T23:18:26.864785Z","submitted_at":"2026-05-07T08:34:14Z","title":"SkillScope: Toward Fine-Grained Least-Privilege Enforcement for Agent Skills","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-08T09:33:30.464441Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.05868"},"observation_digest":"sha256:0980abc75b0c3f8c835de680d071ab74155b95d3cc55f48aba00d8c650e636ba","observation_id":"caedab10-38be-483a-a0d6-aa57bda95a27","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:f04fab6d9d749b0eeffd70081617ac2f3387028da7b3cecff22489eab03e486e","observation_id":"3790cb3c-65a3-4eb4-9d82-9fa95ff9aab5","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.10448","last_updated":"2026-05-11T12:20:15Z","snapshot_observed_at":"2026-08-04T21:52:34.354755Z","submitted_at":"2026-05-11T12:20:15Z","title":"Can Agent Benchmarks Support Their Scores? Evidence-Supported Bounds for Interactive-Agent Evaluation","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-12T05:05:55.592359Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.10448"},"observation_digest":"sha256:c492e0d7d9734d09e5e9c898c3fd3b6d0c85f9eebd0d1c6716e533f8bf2a4de9","observation_id":"1b876bbc-9c86-408d-8e5b-5b81ebe6e118","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.10481","last_updated":"2026-05-11T12:43:19Z","snapshot_observed_at":"2026-07-06T23:22:28.318343Z","submitted_at":"2026-05-11T12:43:19Z","title":"Safe Multi-Agent Behavior Must Be Maintained, Not Merely Asserted: Constraint Drift in LLM-Based Multi-Agent Systems","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-12T04:17:12.046360Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.10481"},"observation_digest":"sha256:84525321d7a60001d013fea5424f3a013ba965a81f29ef6337e83ea35df32aa3","observation_id":"8f512b75-6b18-4819-a9fb-50ec2961aaf3","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.11026","last_updated":"2026-05-10T20:08:27Z","snapshot_observed_at":"2026-07-06T23:22:57.012338Z","submitted_at":"2026-05-10T20:08:27Z","title":"AgentShield: Deception-based Compromise Detection for Tool-using LLM Agents","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-13T01:31:34.468389Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.11026"},"observation_digest":"sha256:85a0d264cf1b121d0a3128a59bcf403151a8d4076f467598ed81c056ae1d54a0","observation_id":"cb26b08e-4fd7-494a-8888-e51de008dbc6","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.11868","last_updated":"2026-05-12T09:48:53Z","snapshot_observed_at":"2026-07-06T23:23:39.723268Z","submitted_at":"2026-05-12T09:48:53Z","title":"IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-13T05:46:07.132408Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.11868"},"observation_digest":"sha256:9d4cfb822dda8151b67815ddf066593dfb513f300e1794b612df11d817efe3c8","observation_id":"11a01580-ed35-45a0-9875-4b5092d32e16","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.12863","last_updated":"2026-05-13T01:21:05Z","snapshot_observed_at":"2026-08-01T20:28:13.724342Z","submitted_at":"2026-05-13T01:21:05Z","title":"Language-Based Agent Control","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-06-30T21:41:37.021482Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.12863"},"observation_digest":"sha256:4096a88074fad9dc684eafc2b21f505fe47a9dfbd45f1e5b8861161656be346f","observation_id":"879c3eff-4e41-44a0-a7f3-22f72b08b904","resolution":{"observed_at":"2026-07-01T14:25:45.923788Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.13471","last_updated":"2026-05-13T12:57:31Z","snapshot_observed_at":"2026-07-06T23:25:01.951546Z","submitted_at":"2026-05-13T12:57:31Z","title":"Sleeper Channels and Provenance Gates: Persistent Prompt Injection in Always-on Autonomous AI Agents","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-14T18:21:06.872045Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.13471"},"observation_digest":"sha256:9445b5a777fce5cdc98dc04f75dfd33945b0a8be6d15aad967b05268a44ba92e","observation_id":"d3efb9a7-d109-4a21-850c-fa349aed3050","resolution":{"observed_at":"2026-05-14T18:22:33.630937Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.13940","last_updated":"2026-05-13T17:04:17Z","snapshot_observed_at":"2026-07-06T23:25:25.361350Z","submitted_at":"2026-05-13T17:04:17Z","title":"AgentTrap: Measuring Runtime Trust Failures in Third-Party Agent Skills","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-15T05:40:52.709457Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.13940"},"observation_digest":"sha256:cd049161836fb050474eac402960d2499a33f24a5a149df67b998024802aef73","observation_id":"e3f6b385-ca71-4e0c-a6e9-df57d030bc0c","resolution":{"observed_at":"2026-05-15T05:45:06.738689Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.14290","last_updated":"2026-05-14T02:48:57Z","snapshot_observed_at":"2026-08-03T04:50:16.568616Z","submitted_at":"2026-05-14T02:48:57Z","title":"Web Agents Should Adopt the Plan-Then-Execute Paradigm","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-15T02:42:05.644536Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.14290"},"observation_digest":"sha256:fb46e8c85f69a60e7fc8b07d8e0f86c147e95c68b2ecdd2dff319973d407a5f6","observation_id":"5fe32da3-8e3c-4503-9be4-9a793e562934","resolution":{"observed_at":"2026-05-15T02:43:33.390770Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.14859","last_updated":"2026-05-15T03:53:20Z","snapshot_observed_at":"2026-07-06T23:26:13.644646Z","submitted_at":"2026-05-14T14:05:58Z","title":"Do Coding Agents Understand Least-Privilege Authorization?","version":2},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-05-19T16:34:14.379419Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.14859"},"observation_digest":"sha256:cd27102f80419f3df12c3184662fac0d6e66e361639c893b3c6d3afe082b23ff","observation_id":"af150bb3-df58-4229-9cb1-9952b74d847a","resolution":{"observed_at":"2026-05-19T16:37:40.072263Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.16282","last_updated":"2026-04-11T04:25:19Z","snapshot_observed_at":"2026-07-06T23:27:29.931962Z","submitted_at":"2026-04-11T04:25:19Z","title":"Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agents","version":1},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-05-21T01:42:55.693115Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.16282"},"observation_digest":"sha256:59025647cb8d7c00e0a614334a660a0df27345f8e04c7de892b501409eaedb0c","observation_id":"317b4b9f-2ad6-44b5-87e3-6709fa52abb7","resolution":{"observed_at":"2026-05-21T01:43:56.937545Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.16976","last_updated":"2026-05-16T12:53:31Z","snapshot_observed_at":"2026-08-02T19:09:38.060554Z","submitted_at":"2026-05-16T12:53:31Z","title":"Securing LLM Agents Need Intent-to-Execution Integrity","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-19T20:17:04.049686Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.16976"},"observation_digest":"sha256:e5f52de946d8aab871307cf05b2bd810b367ef30c82cd4fba87de63cfd8cdbd1","observation_id":"9a9291f2-2fda-4ca3-beea-e84e0c920e30","resolution":{"observed_at":"2026-05-19T20:17:45.538684Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.18133","last_updated":"2026-05-18T09:38:18Z","snapshot_observed_at":"2026-07-06T23:29:04.241654Z","submitted_at":"2026-05-18T09:38:18Z","title":"An Empirical Study of Privacy Leakage Chains via Prompt Injection in Black-Box Chatbot Environments","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-20T09:58:05.349147Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.18133"},"observation_digest":"sha256:6a84f975f0e65395fba23eab5e66a194ef6456acd48902a358d167a707d00088","observation_id":"02e55ae4-2c9b-42ba-a2b8-7a7087d6f24a","resolution":{"observed_at":"2026-05-20T09:58:10.834218Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.29659","last_updated":"2026-05-28T09:21:42Z","snapshot_observed_at":"2026-07-06T23:39:05.858969Z","submitted_at":"2026-05-28T09:21:42Z","title":"Opir: Efficient Multi-Task Safety Classification for Toxicity, Jailbreaks, Hate Speech, and Harmful Content","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-06-29T09:11:58.843585Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.29659"},"observation_digest":"sha256:c1084ec795ced2d47e230c5a0c5dc390a756912aaad62ebc10721ad60c8c5eac","observation_id":"aec41180-216c-4bc0-969d-f7424c34cf6d","resolution":{"observed_at":"2026-06-29T09:13:16.008758Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.02668","last_updated":"2026-06-01T11:08:17Z","snapshot_observed_at":"2026-07-06T23:43:02.654629Z","submitted_at":"2026-06-01T11:08:17Z","title":"What You Approve Is What Executes: Consent Integrity for Black-Box LLM Agents","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-06-28T14:12:38.815852Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.02668"},"observation_digest":"sha256:0b8e3122aaee8386f27a76ab7acd9d57ac88ea311ed7e826937861fc4eed09f1","observation_id":"18bb0984-6bd1-46ee-b277-35e34aad5b46","resolution":{"observed_at":"2026-07-01T23:36:22.954847Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.03024","last_updated":"2026-07-13T09:09:56Z","snapshot_observed_at":"2026-08-03T09:57:52.601562Z","submitted_at":"2026-06-02T02:01:53Z","title":"SkillGuard: A Permission-Centric Framework for Agent Skill Security","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-06-28T10:07:36.872590Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.03024"},"observation_digest":"sha256:81f517f03cdce85d3f01923f44dcc7661c9f91ddde2ffb508ccad76a448cb722","observation_id":"dde41c9f-18b0-4c51-b51b-0e7622e8179e","resolution":{"observed_at":"2026-07-02T03:26:28.567926Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-14T18:32:00.165926Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.03024","last_updated":"2026-07-13T09:09:56Z","snapshot_observed_at":"2026-08-03T09:57:52.601562Z","submitted_at":"2026-06-02T02:01:53Z","title":"SkillGuard: A Permission-Centric Framework for Agent Skill Security","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-07-14T18:32:00.165926Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.03024"},"observation_digest":"sha256:fbaddd5a5d28c85dd2b3172847f1632c79e67b86b0993d49f9b9d17a6faf50a9","observation_id":"5542bc3e-7415-4e21-a4f5-99dc34860483","resolution":{"observed_at":"2026-07-14T18:32:00.165926Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.04141","last_updated":"2026-06-02T18:53:17Z","snapshot_observed_at":"2026-08-02T13:02:03.082813Z","submitted_at":"2026-06-02T18:53:17Z","title":"Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-06-28T09:15:57.044886Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.04141"},"observation_digest":"sha256:c2b7925f937089b8aec7b28e2140901eee781646cd71289e28a07773893c3686","observation_id":"7d11ff01-04da-495c-8f7b-104026eb1327","resolution":{"observed_at":"2026-07-02T04:16:36.065303Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.05233","last_updated":"2026-06-03T01:21:59Z","snapshot_observed_at":"2026-08-03T04:28:49.622809Z","submitted_at":"2026-06-03T01:21:59Z","title":"Domain-Conditioned Safety in Frontier Computer-Using Agents: A 793-Episode Browser Benchmark, a Coding-Domain Cross-Reference, and a Reproducibility Audit of Recent Red-Teaming","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-06-28T06:22:03.848058Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.05233"},"observation_digest":"sha256:83c4002f58031b515dab85179128b5c2a0b5c47cba70557088e610891d06b141","observation_id":"e4a7d3ec-6a9c-4bdc-b63c-7740c646021b","resolution":{"observed_at":"2026-07-02T08:06:48.201108Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.07131","last_updated":"2026-06-19T05:32:49Z","snapshot_observed_at":"2026-08-02T16:39:25.195665Z","submitted_at":"2026-06-05T10:43:19Z","title":"MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills","version":3},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-06-27T21:44:55.308871Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.07131"},"observation_digest":"sha256:beba89f61d1e6414aeb51494312dfd6f49d02314ee2c1ffa8117b24affc677a9","observation_id":"7c95bd8e-460c-43b9-893f-2beaa62f3b76","resolution":{"observed_at":"2026-06-27T21:51:18.647089Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.07805","last_updated":"2026-06-05T19:33:58Z","snapshot_observed_at":"2026-08-03T01:44:22.181409Z","submitted_at":"2026-06-05T19:33:58Z","title":"Beyond Goodhart's Law: A Dynamic Benchmark for Evaluating Compliance in Multi-Agent Systems","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-06-27T21:53:37.616447Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.07805"},"observation_digest":"sha256:51835f6a52e99a399c1f3df761b278b7dd672a2bdfe9b6747058ba7b1c3404da","observation_id":"bbf746c7-10c3-4c38-b8bc-ada130482443","resolution":{"observed_at":"2026-07-02T17:47:17.795514Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.10106","last_updated":"2026-06-08T19:35:37Z","snapshot_observed_at":"2026-08-01T08:26:23.637148Z","submitted_at":"2026-06-08T19:35:37Z","title":"What makes a harness a harness: necessary and sufficient conditions for an agent harness","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-06-27T15:15:57.372858Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.10106"},"observation_digest":"sha256:b911e2b6ed356b28a1a60024ee92ecdc548d68917d2cef8961453c2c8541ffac","observation_id":"7d99e4e1-789a-4268-a8d1-eb3e35aef32e","resolution":{"observed_at":"2026-06-27T19:31:10.763998Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.10304","last_updated":"2026-06-09T01:45:19Z","snapshot_observed_at":"2026-07-06T23:49:32.647742Z","submitted_at":"2026-06-09T01:45:19Z","title":"MIRAGE: A Polarity-Flipping Encoding Subspace in LLM Agents","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-06-27T13:33:24.087333Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.10304"},"observation_digest":"sha256:a69b68f7d6697da8e657fdaea36e65aeafa77add15f52a3b3acd209961155269","observation_id":"c6256fd3-9d9c-478a-ae6a-deb9bdc6208d","resolution":{"observed_at":"2026-07-03T04:57:38.189356Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.10322","last_updated":"2026-06-09T02:18:44Z","snapshot_observed_at":"2026-08-01T07:26:53.142922Z","submitted_at":"2026-06-09T02:18:44Z","title":"Game-Theoretic Multi-Agent Control for Robust Contextual Reasoning in LLMs","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-06-27T13:05:57.618969Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.10322"},"observation_digest":"sha256:ac063c8f5d991f82a554cf0844732675aa46fb7d41d3758e18ef9d1102368e9e","observation_id":"63c68b64-6b2c-45f4-8e3e-9181647187e7","resolution":{"observed_at":"2026-07-03T05:47:41.217168Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:709aaef57e6d9140a950ed094d324d1971cbe720c6f09be3be1879dd5219056e","observation_id":"178ae034-1097-4fcf-b79e-8610f6c32b11","resolution":{"observed_at":"2026-07-03T06:17:41.857461Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.12290","last_updated":"2026-06-10T16:26:46Z","snapshot_observed_at":"2026-08-02T00:16:37.704294Z","submitted_at":"2026-06-10T16:26:46Z","title":"Selection Integrity for LLM Graph Memory: An Accumulability Criterion for Information-Flow-Blind Retrieval","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-06-27T09:13:58.485088Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.12290"},"observation_digest":"sha256:bdfa429b8948ba111d0e282b8f3ea131c41c00c2dc05d88ebc95d48a186e0ab6","observation_id":"f100781b-b9ed-464d-9b28-86f172f8e45d","resolution":{"observed_at":"2026-07-03T11:58:06.309031Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.12320","last_updated":"2026-06-10T16:54:47Z","snapshot_observed_at":"2026-07-30T03:53:23.122847Z","submitted_at":"2026-06-10T16:54:47Z","title":"A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-06-27T10:09:35.461423Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.12320"},"observation_digest":"sha256:b76a11f5bed4349134b3c5f418ed33d4722f22dadcac37feb6b7e44983b4a32c","observation_id":"7e8ba950-a637-4bdb-9b18-24c5e7d9b125","resolution":{"observed_at":"2026-07-03T10:17:57.602508Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.12341","last_updated":"2026-06-10T17:13:35Z","snapshot_observed_at":"2026-07-06T23:51:17.719874Z","submitted_at":"2026-06-10T17:13:35Z","title":"OCELOT: Inference-Leakage Budgets for Privacy-Preserving LLM Agents","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-06-27T09:11:42.204778Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.12341"},"observation_digest":"sha256:021000105b94f97a37d4d365364f5a8bb94f37d832eab65ba02b6cad0545824b","observation_id":"500e4ca8-4171-41ed-8beb-803f4e90a215","resolution":{"observed_at":"2026-07-03T11:58:06.918487Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.17114","last_updated":"2026-06-15T09:16:38Z","snapshot_observed_at":"2026-08-02T23:25:19.283217Z","submitted_at":"2026-06-15T09:16:38Z","title":"An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-06-27T03:39:36.657903Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.17114"},"observation_digest":"sha256:ce03c06f8a74fc4d1748b1897e64926ff0a835bd5f15777572bc501753707758","observation_id":"dda5fbee-69a1-43b6-949c-1f47710b80df","resolution":{"observed_at":"2026-07-03T17:48:46.340833Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.18356","last_updated":"2026-06-16T18:04:45Z","snapshot_observed_at":"2026-07-06T23:53:49.904730Z","submitted_at":"2026-06-16T18:04:45Z","title":"SafeClawBench: Separating Semantic, Audit-Evidence, and Sandbox Harm in Tool-Using LLM Agents","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-06-26T23:40:53.439549Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.18356"},"observation_digest":"sha256:bf1b77f53c400d5d6b7eb5e6d3ac0fbb032ca059c358e85a4380c1c4c952dcaf","observation_id":"b3d83305-a218-4ca3-b110-60ba7af92010","resolution":{"observed_at":"2026-07-03T22:18:59.725787Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.18550","last_updated":"2026-06-17T00:00:11Z","snapshot_observed_at":"2026-08-03T01:10:08.307815Z","submitted_at":"2026-06-17T00:00:11Z","title":"The Gate Is Only as Honest as Its Contracts: ContractGuard for the Contract Layer of Risk-Aware Causal Gating","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-06-26T20:58:24.056435Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.18550"},"observation_digest":"sha256:f4674cecb8f1542b82f20c7ac10293f89006246e98c9893f6f4152690c1f31dc","observation_id":"d1a3f0ae-45e1-4bc2-9898-b77884e37346","resolution":{"observed_at":"2026-07-04T00:49:18.321344Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.22560","last_updated":"2026-06-21T15:36:04Z","snapshot_observed_at":"2026-08-02T21:53:03.265516Z","submitted_at":"2026-06-21T15:36:04Z","title":"Evidence-Bound Gateway-Path Provenance for Third-Party LLM Inference","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-06-26T10:07:23.015655Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.22560"},"observation_digest":"sha256:8a6616a58e0e69bdfda962ff781e1232b905ceda907579e76afb6a75c3bbb471","observation_id":"b8ef15ad-48ce-4796-962e-2c398d00f31d","resolution":{"observed_at":"2026-07-04T09:19:44.168714Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.23049","last_updated":"2026-06-24T02:20:35Z","snapshot_observed_at":"2026-07-06T23:57:53.101659Z","submitted_at":"2026-06-22T08:57:54Z","title":"PhoneBuddy: Training Open Models for Agentic Phone Use","version":2},"reference_index":69,"source":"arxiv_source","source_observed_at":"2026-06-26T08:15:49.428124Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.23049"},"observation_digest":"sha256:702134683d0453920a7e715822d6cd9e51576d963c04b2c9e1d724a5e938d277","observation_id":"de6b5fe5-d724-4c49-8866-523c5e1b536e","resolution":{"observed_at":"2026-07-04T10:59:46.403482Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.24589","last_updated":"2026-06-23T13:50:51Z","snapshot_observed_at":"2026-07-06T23:59:08.580746Z","submitted_at":"2026-06-23T13:50:51Z","title":"AdversaBench: Automated LLM Red-Teaming with Multi-Judge Confirmation and Cross-Model Transferability","version":1},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-06-25T23:49:17.752279Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.24589"},"observation_digest":"sha256:b9aff4b36324613b2d2284bc71c6d30708ae4aac3985823aafecb61aa9f71b4c","observation_id":"609c963e-c9a5-4b8d-89fc-e3c4770727a8","resolution":{"observed_at":"2026-07-04T17:20:00.224489Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.26356","last_updated":"2026-06-24T20:09:28Z","snapshot_observed_at":"2026-08-03T13:55:34.475640Z","submitted_at":"2026-06-24T20:09:28Z","title":"Instruction Bleed: Cross-Module Interference in Prompt-Composed Agentic Systems","version":1},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-06-26T01:42:22.071423Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.26356"},"observation_digest":"sha256:3c21377988259fb1845a94130830fdf3a7a526a675717193874d9530be10f419","observation_id":"865d15c6-7e04-4b67-8ace-521e01645232","resolution":{"observed_at":"2026-07-04T15:19:56.808838Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.26479","last_updated":"2026-06-25T00:35:23Z","snapshot_observed_at":"2026-07-07T00:00:46.505337Z","submitted_at":"2026-06-25T00:35:23Z","title":"Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-06-26T04:58:59.046289Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.26479"},"observation_digest":"sha256:016859021f053a3d52c2f25777a6c3ecc904f9a18d9dfb79d60e278781e126d8","observation_id":"3ba48789-8040-4847-a1ec-918f892bfd72","resolution":{"observed_at":"2026-07-04T13:39:51.365420Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.26627","last_updated":"2026-06-25T05:44:18Z","snapshot_observed_at":"2026-08-02T09:36:56.612724Z","submitted_at":"2026-06-25T05:44:18Z","title":"Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-06-26T04:29:16.386339Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.26627"},"observation_digest":"sha256:b85e6c0cdda7d777b5c0b75560b2d52ca540fb7542d5644482a7af0959c96162","observation_id":"4c7e139a-087d-4712-bdc2-72ba58177369","resolution":{"observed_at":"2026-07-04T14:09:53.245984Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.28679","last_updated":"2026-06-27T01:33:19Z","snapshot_observed_at":"2026-07-07T00:02:43.396508Z","submitted_at":"2026-06-27T01:33:19Z","title":"Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-06-30T10:13:22.634230Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.28679"},"observation_digest":"sha256:d16d62c2f4c87187648e1bc1f62a215f9c3304c1d1fd8ae34a897a83f441acaa","observation_id":"facb84fe-9fec-4969-ae71-36147ca8ca32","resolution":{"observed_at":"2026-06-30T10:14:36.003989Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.29073","last_updated":"2026-06-27T20:17:43Z","snapshot_observed_at":"2026-08-03T08:43:53.227502Z","submitted_at":"2026-06-27T20:17:43Z","title":"From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-06-30T09:15:20.593625Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.29073"},"observation_digest":"sha256:712428533adc490d68ca3e476c1b037071161fd6f08c5f499d570e83825c605a","observation_id":"ee39c90f-3b38-4d15-85f0-6f3b8bc86c95","resolution":{"observed_at":"2026-06-30T09:24:32.785879Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.29225","last_updated":"2026-06-28T06:27:36Z","snapshot_observed_at":"2026-08-02T09:56:14.615866Z","submitted_at":"2026-06-28T06:27:36Z","title":"PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents","version":1},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-06-30T07:48:36.924294Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.29225"},"observation_digest":"sha256:088a2479e31c2c1aa7f251c27d3ca078df2c27e665ce3c72ff3caf5b08fba500","observation_id":"50867cfe-172d-4bf7-82ba-972feaa49ee4","resolution":{"observed_at":"2026-06-30T07:54:22.256590Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.29537","last_updated":"2026-07-13T10:30:17Z","snapshot_observed_at":"2026-07-17T23:18:06.822637Z","submitted_at":"2026-06-28T17:59:17Z","title":"OSWorld 2.0: Benchmarking Computer Use Agents on Long-Horizon Real-World Tasks","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-06-30T07:10:38.909339Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.29537"},"observation_digest":"sha256:7d437fa90e26b5093358541d4f20e3c333ff06529fd642156ed52fcefa2a2050","observation_id":"a21b9661-8786-45ee-bac8-a9c50c9ec0c5","resolution":{"observed_at":"2026-06-30T07:14:21.219776Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-15T10:24:53.345620Z","title":"AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.29537","last_updated":"2026-07-13T10:30:17Z","snapshot_observed_at":"2026-07-17T23:18:06.822637Z","submitted_at":"2026-06-28T17:59:17Z","title":"OSWorld 2.0: Benchmarking Computer Use Agents on Long-Horizon Real-World Tasks","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-07-15T10:24:53.345620Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.29537"},"observation_digest":"sha256:1af02f34a34d4b841e0f4bb46e5935281a1839d4deb4aedaddb4099b7bda16aa","observation_id":"0822cdb2-d7f7-4e3d-bc79-e97693caba7d","resolution":{"observed_at":"2026-07-15T10:24:53.345620Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.30306","last_updated":"2026-06-29T13:47:42Z","snapshot_observed_at":"2026-08-03T21:13:43.609810Z","submitted_at":"2026-06-29T13:47:42Z","title":"Always-OnAgents:A Survey of Persistent Memory, State, and Governance in LLMAgents","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-06-30T03:44:51.320606Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.30306"},"observation_digest":"sha256:de683afd47c4e7bc1402047c5c4f56d106b16d89daeacf892ff82597ec965c7f","observation_id":"af5a73e0-915f-4a68-b848-f0658247918b","resolution":{"observed_at":"2026-07-01T15:15:48.384194Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.30383","last_updated":"2026-06-29T14:39:38Z","snapshot_observed_at":"2026-08-04T03:27:44.496352Z","submitted_at":"2026-06-29T14:39:38Z","title":"Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agents","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-06-30T05:48:15.990443Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.30383"},"observation_digest":"sha256:6a50a8ab145e4f931f5047c9d1773eecbc970b31e5fb86ea552f62beaeb4cab3","observation_id":"198a9dd2-5b7a-41eb-ae77-7435b508e571","resolution":{"observed_at":"2026-06-30T13:44:41.466230Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.31272","last_updated":"2026-06-30T07:45:33Z","snapshot_observed_at":"2026-07-31T11:59:14.450119Z","submitted_at":"2026-06-30T07:45:33Z","title":"The Decomposition Is the Fingerprint: Per-Component Identity for Agent Skills","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-07-01T05:44:44.015852Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.31272"},"observation_digest":"sha256:7b0564f9e704caabe374cc8c15e5b0a218845b4f65a523b846f4fcd317023f6d","observation_id":"dd5f8aaf-afc2-4f4a-90bc-403fa1db3591","resolution":{"observed_at":"2026-07-01T10:15:44.226042Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.31639","last_updated":"2026-06-30T13:21:43Z","snapshot_observed_at":"2026-08-03T05:59:43.224416Z","submitted_at":"2026-06-30T13:21:43Z","title":"A Lifecycle and Application-Stack Survey of Large Language Model Vulnerabilities: Attacks, Risks, Defenses, and Open Problems","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-07-01T04:44:23.543728Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.31639"},"observation_digest":"sha256:f9bc184bf812b0c225d300d304808557e661b861090c0a29a2c27e824fedd395","observation_id":"a8ae2483-73c7-457d-a3e6-fd0ce874e158","resolution":{"observed_at":"2026-07-01T11:05:42.304149Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-12T06:34:07.307906Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.02857","last_updated":"2026-07-03T01:41:17Z","snapshot_observed_at":"2026-07-12T06:34:06.956598Z","submitted_at":"2026-07-03T01:41:17Z","title":"MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-07-12T06:34:07.307906Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.02857"},"observation_digest":"sha256:ca35a64ed44c3d9d6c91d8fd78bfd054effc4a85566dc97aff7894ecf27e3add","observation_id":"c0db0c18-7085-42b6-aca0-8029263558f4","resolution":{"observed_at":"2026-07-12T06:34:07.307906Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T07:27:13.586286Z","title":"AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05483","last_updated":"2026-07-06T16:13:56Z","snapshot_observed_at":"2026-08-02T23:23:22.002382Z","submitted_at":"2026-07-06T16:13:56Z","title":"PatchOptic for Shared-State LLM Workflows with Projected Views and Verified Structured Updates","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-11T07:27:13.586286Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.05483"},"observation_digest":"sha256:373f67b3ec65bde380db087aee9e88cfb34895f1682c602ed1501a2d87546742","observation_id":"1bda5eb4-8c60-4fa4-85c1-75185cd8d7eb","resolution":{"observed_at":"2026-07-11T07:27:13.586286Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2607.05743","last_updated":"2026-07-07T01:56:18Z","snapshot_observed_at":"2026-08-02T11:31:43.915259Z","submitted_at":"2026-07-07T01:56:18Z","title":"The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-07-11T02:41:24.813416Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.05743"},"observation_digest":"sha256:558a46604cb422cd82abb111c3ce5a5dc67a9246656314b17d0498519a758dd3","observation_id":"c0ddd73e-d30e-463a-83c4-e9b2723a7a75","resolution":{"observed_at":"2026-07-11T02:47:49.893444Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2607.07676","last_updated":"2026-07-08T17:34:28Z","snapshot_observed_at":"2026-08-04T22:55:13.068885Z","submitted_at":"2026-07-08T17:34:28Z","title":"SkillCenter: A Large-Scale Source-Grounded Skill Library for Autonomous AI Agents","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-07-09T03:01:02.743557Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.07676"},"observation_digest":"sha256:82b94d24ff2bdc3bf58234257920cbfc9219f107cc63d0ee90842b9873278b8a","observation_id":"e19acec7-242c-473c-ac4b-852b39f7b1aa","resolution":{"observed_at":"2026-07-09T03:05:54.910197Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-14T11:00:53.732771Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.10534","last_updated":"2026-07-12T02:07:37Z","snapshot_observed_at":"2026-08-04T18:43:16.625900Z","submitted_at":"2026-07-12T02:07:37Z","title":"Cross-Layer Misalignment Detection in Agent Skills: A Progressive Loading-Aware Contrastive Learning Approach","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-07-14T11:00:53.732771Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.10534"},"observation_digest":"sha256:77989a61afca65a28fd07fc5632bd1558d22b31cc9b3af253c14cc2016f0c559","observation_id":"bb9fffc1-fab4-4989-8e6a-5364c47ebf1e","resolution":{"observed_at":"2026-07-14T11:00:53.732771Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-14T07:09:56.559355Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.11086","last_updated":"2026-07-13T04:55:16Z","snapshot_observed_at":"2026-08-03T15:13:18.566158Z","submitted_at":"2026-07-13T04:55:16Z","title":"Rethinking MCP Security: A Large-Scale Study of Runtime MCP Servers and Security Scanner Reliability","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-14T07:09:56.559355Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.11086"},"observation_digest":"sha256:7f64b66c5119fa80835a5f6a0bed8911979309e2b7d60e6582c7eacf2ed46192","observation_id":"045f7432-0ec7-4939-ac6a-0f1652381e62","resolution":{"observed_at":"2026-07-14T07:09:56.559355Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-14T03:26:15.676915Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.11751","last_updated":"2026-07-13T16:08:46Z","snapshot_observed_at":"2026-08-04T12:45:21.737353Z","submitted_at":"2026-07-13T16:08:46Z","title":"When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems","version":1},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-07-14T03:26:15.676915Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.11751"},"observation_digest":"sha256:a8a8452f4bbcafedbf2e44eb9a2ea7eb0993a86c6c20472098b933f5180d054e","observation_id":"77db2a3f-1581-4c02-8689-f5739195167c","resolution":{"observed_at":"2026-07-14T03:26:15.676915Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-02T05:15:04.635408Z","title":"AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.14166","last_updated":"2026-07-17T08:59:39Z","snapshot_observed_at":"2026-08-02T05:14:51.697723Z","submitted_at":"2026-07-15T05:55:38Z","title":"Stop Means Stop: Measuring and Repairing the Enforcement Gap in Agent-Framework Control Primitives","version":2},"reference_index":89,"source":"pdf_text","source_observed_at":"2026-08-02T05:15:04.635408Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.14166"},"observation_digest":"sha256:e2679aef34f6a3d5b564f5c80d7129547efaab8c96f410cd8368615fc37b9eb3","observation_id":"0ffe9b14-f5a6-47c1-9b4a-ea6780a7c09f","resolution":{"observed_at":"2026-08-02T05:15:04.635408Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-01T16:35:19.029397Z","title":"AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17951","last_updated":"2026-07-20T13:52:24Z","snapshot_observed_at":"2026-08-01T16:35:11.384780Z","submitted_at":"2026-07-20T13:52:24Z","title":"RT-SHCUA: Real-Time Self-Hosted Computer-Use Agent for UAV Control","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-01T16:35:19.029397Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.17951"},"observation_digest":"sha256:5da93e0f8589bb97ca066d0bb81e8042588db315ac7715bbc210612b663a284b","observation_id":"ffc75da8-0cea-4346-99f2-95bdd71fb870","resolution":{"observed_at":"2026-08-01T16:35:19.029397Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-01T16:19:08.615174Z","title":"AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents.arXiv preprint arXiv:2406.13352,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-01T16:19:07.520649Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.615174Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:b6329ed0d92c6f7b6b368edb1c07d44df3589179d6484816f6eff66ccf19b2fc","observation_id":"20af0eb7-595f-4044-ac48-05c1df91ff6a","resolution":{"observed_at":"2026-08-01T16:19:08.615174Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-01T12:59:47.924753Z","title":"AgentDojo : A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.19267","last_updated":"2026-07-21T16:38:32Z","snapshot_observed_at":"2026-08-01T12:59:46.573167Z","submitted_at":"2026-07-21T16:38:32Z","title":"They'll Verify. They Just Won't Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface","version":1},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-01T12:59:47.924753Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.19267"},"observation_digest":"sha256:0a6607a3cdf3b439514d26aa4cdff8efd84bcfa3dd738391c4066feb708c6d5e","observation_id":"82f28bfb-55d9-45a7-98a4-e743b9210001","resolution":{"observed_at":"2026-08-01T12:59:47.924753Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-01T09:30:51.184109Z","title":"AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.20759","last_updated":"2026-07-22T22:20:02Z","snapshot_observed_at":"2026-08-04T00:17:22.539121Z","submitted_at":"2026-07-22T22:20:02Z","title":"IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-01T09:30:51.184109Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.20759"},"observation_digest":"sha256:d6ca72cbd8128ce89030cc7b050fa23d64a93665143287e6e5be530c6108c810","observation_id":"707e6df5-b157-4010-89ce-b5f06de4baab","resolution":{"observed_at":"2026-08-01T09:30:51.184109Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-31T23:24:19.522434Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-03T08:43:31.893929Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.522434Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:6ed215a3bba9e84924eb61fd5372edc93f44e348504938182ffadeaadc5795ea","observation_id":"03d99116-2a6c-42d7-a133-65f741bf37b5","resolution":{"observed_at":"2026-07-31T23:24:19.522434Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-31T10:25:15.498142Z","title":"2024.AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.24625","last_updated":"2026-07-27T16:19:45Z","snapshot_observed_at":"2026-08-04T21:51:33.280706Z","submitted_at":"2026-07-27T16:19:45Z","title":"Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-31T10:25:15.498142Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.24625"},"observation_digest":"sha256:66237a1ae7977e4b4448d4941bc012321a276e3233c94129b78ba07fdad1135b","observation_id":"ed1c6a41-01bc-413f-afda-f1ea1b4c21b3","resolution":{"observed_at":"2026-07-31T10:25:15.498142Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-01T03:01:01.131934Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.25255","last_updated":"2026-07-29T23:58:46Z","snapshot_observed_at":"2026-08-02T23:20:20.432726Z","submitted_at":"2026-07-28T03:55:47Z","title":"SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems","version":2},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-08-01T03:01:01.131934Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.25255"},"observation_digest":"sha256:758def8135a370622a6bcc131a73a60f0101f730627f0f2e50ea82c16bb31db9","observation_id":"293a6212-7cae-4f9a-bf56-d3a53af48d8c","resolution":{"observed_at":"2026-08-01T03:01:01.131934Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-01T01:12:44.130108Z","title":"Deng, Y., Yang, Y., Zhang, J., Wang, W., and Li, B","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.26115","last_updated":"2026-07-28T16:03:39Z","snapshot_observed_at":"2026-08-03T09:49:36.555011Z","submitted_at":"2026-07-28T16:03:39Z","title":"GPT-Red: Automated Red Teaming via Self-Play at Scale","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-01T01:12:44.130108Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.26115"},"observation_digest":"sha256:9be02a916bcb1dd4ee72f6addd80e7296cbf3e8c174bdff8abf2c945d32c17e9","observation_id":"7be87c14-6d5f-4a38-83dc-6b1456f5942a","resolution":{"observed_at":"2026-08-01T01:12:44.130108Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-01T11:00:07.379881Z","title":"AgentDojo : A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.27267","last_updated":"2026-07-29T09:41:07Z","snapshot_observed_at":"2026-08-04T22:26:57.186715Z","submitted_at":"2026-07-29T09:41:07Z","title":"FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs","version":1},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-01T11:00:07.379881Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.27267"},"observation_digest":"sha256:35571c92786773e1e05e1e335118f66fb1fbed010e1df35eff0fe72633fcda29","observation_id":"a0a97666-e4d5-465b-be62-c1bad4654660","resolution":{"observed_at":"2026-08-01T11:00:07.379881Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-03T00:45:58.624640Z","title":"Advances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track , year =","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.28685","last_updated":"2026-07-30T03:45:10Z","snapshot_observed_at":"2026-08-05T00:13:19.152927Z","submitted_at":"2026-07-30T03:45:10Z","title":"Safety, or Just Capability? A Validity Audit of Agent-Safety Benchmarks","version":1},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-03T00:45:58.624640Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.28685"},"observation_digest":"sha256:dac118fb0f81a780f95c971fd404c10b160001ebfc07452b87cadffa4daedb6a","observation_id":"a07a1851-a34c-4d38-99bb-677067aee1d7","resolution":{"observed_at":"2026-08-03T00:45:58.624640Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-03T12:01:12.135104Z","title":"Advances in Neural Information Processing Systems 37 (NeurIPS 2024), Datasets and Benchmarks Track , year =","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.29190","last_updated":"2026-07-31T09:11:56Z","snapshot_observed_at":"2026-08-05T00:16:28.746235Z","submitted_at":"2026-07-31T09:11:56Z","title":"CAGE: Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents","version":1},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-03T12:01:12.135104Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.29190"},"observation_digest":"sha256:4b34504b93c9d72f5eb25d9b00bac5ec15b4f060c0aec562a7406f2d2b46ecfe","observation_id":"742e4277-9a71-49de-9c24-87fa0d59f084","resolution":{"observed_at":"2026-08-03T12:01:12.135104Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-03T07:41:24.239002Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.29405","last_updated":"2026-07-31T13:24:34Z","snapshot_observed_at":"2026-08-05T00:20:09.115367Z","submitted_at":"2026-07-31T13:24:34Z","title":"Beyond Component Testing: Validating Agentic AI Systems","version":1},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-03T07:41:24.239002Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.29405"},"observation_digest":"sha256:dd7c6996b733c858980a20c560a6dd1230d0bb8a649ab16e9dfa5349d17c0f84","observation_id":"44fb06ff-73b0-4697-b56b-6f6f22096a90","resolution":{"observed_at":"2026-08-03T07:41:24.239002Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2406.13352/citation-record","integrity":"/paper/2406.13352/integrity","json":"/paper/2406.13352/citation-record.json","paper":"/paper/2406.13352"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"0203.366332","doi":"10.1145/3650203.3663326","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"Croissant: A metadata format for ml-ready datasets","venue":null,"work_id":"b13e2013-4762-4e9a-97b5-74aa550ddbde","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:c0bd3fe49dbc0f0dc90a63725c9c105c9d96151e37a48b7b14e4fa392cbc310e","observation_id":"89a9c5c8-b9f9-489d-a65d-c45d3298d0d1","resolution":{"observed_at":"2026-05-13T06:35:13.387085Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"The Claude 3 Model Family: Opus, Sonnet, Haiku","venue":null,"work_id":"d692169b-0d64-4638-b78a-14576f1ca990","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:72f313edeee6cf385c13b80694f6aa2f30ba281038ff19650c4327ac788bf9e9","observation_id":"b56a0a3d-0a6f-4ada-a6df-c527f0dd9a8f","resolution":{"observed_at":"2026-05-13T06:35:13.552364Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Tool use (function calling)","venue":null,"work_id":"60a265a5-bb85-404d-826e-7c8d6445462a","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:2c052beed62791a7d91654d2bc06d569f9121fd09e92331bd4f8b21c98fa83ff","observation_id":"e570c438-9dcc-4f2c-b99f-990a46667af4","resolution":{"observed_at":"2026-05-13T06:35:13.588539Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2204.05862","last_updated":"2022-04-12T15:02:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-04-12T15:02:38Z","title":"Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback","version":1},"cited_work":{"arxiv_id":"2204.05862","doi":"10.1016/j.respol.2005.01.014","metadata_source":"pith","pith_arxiv_id":"2204.05862","snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback","venue":"cs.CL","work_id":"a1f2574b-a899-4713-be60-c87ba332656c","year":2022},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2204.05862","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:ba3364b7f141b023b2c43673c20bb2865f1dd29ae6621a8d49476a8802ec5939","observation_id":"9138d2ac-a93b-48c4-93b7-748952c6f4f9","resolution":{"observed_at":"2026-05-13T06:35:13.407091Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Language models are few-shot learners","venue":null,"work_id":"0668d8ab-e260-41af-ace5-c065a5d6ed0f","year":2020},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:510fe68eae6910e9544c1d7e5dcf2b4046092c8fe18a953880d8f93cf42c8065","observation_id":"953b48fe-7719-4e63-ad9b-9c27dd491b80","resolution":{"observed_at":"2026-05-13T06:35:13.628747Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1905.07112","last_updated":"2019-05-17T04:26:52Z","snapshot_observed_at":"2026-07-06T07:53:40.297844Z","submitted_at":"2019-05-17T04:26:52Z","title":"A critique of the DeepSec Platform for Security Analysis of Deep Learning Models","version":1},"cited_work":{"arxiv_id":"1905.07112","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"1905.07112","snapshot_observed_at":"2026-07-04T23:38:16.946516Z","title":"A critique of the deepsec platform for security analysis of deep learning models","venue":null,"work_id":"5feaedcf-5e1b-4729-a00f-59287e5c7121","year":1905},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/1905.07112","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:81e9d062bede3ee6b2eb2b73c6664c9d26630bf29bbd91aa96240f79b927e5ea","observation_id":"4fd8827a-8983-44d3-a2d1-5c80a793f94c","resolution":{"observed_at":"2026-07-04T23:38:16.946516Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.01318","last_updated":"2024-10-31T22:26:40Z","snapshot_observed_at":"2026-08-02T14:59:12.115203Z","submitted_at":"2024-03-28T02:44:02Z","title":"JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models","version":5},"cited_work":{"arxiv_id":"2404.01318","doi":"10.48550/arxiv.2404.01318","metadata_source":"pith","pith_arxiv_id":"2404.01318","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models","venue":"cs.CR","work_id":"a8e91fcd-dc7a-457f-91b8-51f660cb3053","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2404.01318","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:d94de44422765d1a984abb137659e9a5e5ad73f88f91a112524e09612c0ea430","observation_id":"c452888b-062f-401a-a538-ab96428606af","resolution":{"observed_at":"2026-05-15T06:08:05.732086Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-05-22T21:23:26.922897+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-22T21:23:26.922897+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.06363","last_updated":"2024-09-25T19:48:39Z","snapshot_observed_at":"2026-07-06T17:27:58.440355Z","submitted_at":"2024-02-09T12:15:51Z","title":"StruQ: Defending Against Prompt Injection with Structured Queries","version":2},"cited_work":{"arxiv_id":"2402.06363","doi":"10.48550/arxiv.2402.06363","metadata_source":"pith","pith_arxiv_id":"2402.06363","snapshot_observed_at":"2026-07-10T12:27:04.056879Z","title":"Struq: Defending against prompt injection with structured queries","venue":"cs.CR","work_id":"5e57b942-26b0-4859-8393-c0fa2c2ad65b","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2402.06363","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:d0aae0add596b15f5543e7e5abe254e58802c1fc4e5f138fdb10676ccbbacd17","observation_id":"bfc9291a-c1de-4504-9997-3d6a8cfbe7f8","resolution":{"observed_at":"2026-05-13T06:35:13.423186Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Introducing Command R+: Our new, most powerful model in the Command R family","venue":null,"work_id":"8f2b1fe6-16d4-43ed-843b-3ba56731bb06","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:65843b3c2e48f1b3cfdd2dc5c214de2bc66ac5ea45547ffb85d72d3ffdc2ea27","observation_id":"5429174b-7370-4691-b2b6-dbe509bd5efc","resolution":{"observed_at":"2026-05-13T06:35:13.561358Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"RobustBench: a standardized adversarial robustness benchmark","venue":null,"work_id":"a5813f5a-6e5e-4c43-be15-6da4f2a7fd76","year":2021},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:6d7d5c7bcae7f7c95cea861e2422b4d585ba2a0d43fea3d828673c00d8bbaba6","observation_id":"1aaa3615-8856-4d9f-86ca-a0404237e649","resolution":{"observed_at":"2026-05-13T06:35:13.616780Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","venue":null,"work_id":"d2a8b67f-00de-4ff9-b819-3f13d9d39754","year":2020},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:77f16ab1de626bed2c0ce58441a46dc0d1cfb7aeab17a9516b726602d1e389f2","observation_id":"7060773a-bedf-4c51-bb63-5ac68fe02c20","resolution":{"observed_at":"2026-05-13T06:35:13.595729Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.07954","last_updated":"2024-06-12T07:27:28Z","snapshot_observed_at":"2026-07-06T18:29:25.765578Z","submitted_at":"2024-06-12T07:27:28Z","title":"Dataset and Lessons Learned from the 2024 SaTML LLM Capture-the-Flag Competition","version":1},"cited_work":{"arxiv_id":"2406.07954","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2406.07954","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Dataset and Lessons Learned from the 2024 SaTML LLM Capture-the-Flag Competition","venue":null,"work_id":"941491e2-09ec-4f69-b718-7b2845bc6c15","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2406.07954","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:2a94db984b2d7aaf87c05093accef495294a27b71fe772f84fec57fc31ccb349","observation_id":"46eab58b-a96d-4a7f-b56c-b0214647c0b1","resolution":{"observed_at":"2026-05-13T06:35:13.428523Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03185","last_updated":"2023-10-04T22:10:01Z","snapshot_observed_at":"2026-07-06T16:27:55.509482Z","submitted_at":"2023-10-04T22:10:01Z","title":"Misusing Tools in Large Language Models With Visual Adversarial Examples","version":1},"cited_work":{"arxiv_id":"2310.03185","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2310.03185","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Misusing Tools in Large Language Models With Visual Adversarial Examples","venue":null,"work_id":"9ec00b87-5f4a-42d8-925c-4689b09bdd4a","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2310.03185","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:dfae418047efa03df31ca267489f3e036fb5412f6998e527ad53951616a9f812","observation_id":"22929a5e-c96d-4f5c-b69b-781da42f1b5e","resolution":{"observed_at":"2026-05-13T06:35:13.396512Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"PAL: Program-aided language models","venue":null,"work_id":"2a417e65-9083-40e7-ab67-0a0a546d5627","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:68bb57e8f0c41cf8e47821353fe20b9e0daa3b53d95a456b82a91542c32c93dd","observation_id":"2e67bca7-fdd3-43b5-bc71-06e41963c640","resolution":{"observed_at":"2026-05-13T06:35:13.583356Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.14020","last_updated":"2024-02-21T18:59:13Z","snapshot_observed_at":"2026-07-06T17:33:33.812898Z","submitted_at":"2024-02-21T18:59:13Z","title":"Coercing LLMs to do and reveal (almost) anything","version":1},"cited_work":{"arxiv_id":"2402.14020","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2402.14020","snapshot_observed_at":"2026-07-02T21:27:24.512005Z","title":"Coercing llms to do and reveal (almost) anything","venue":null,"work_id":"19f05728-aabb-4e0d-b82d-9e42162fa940","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2402.14020","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:3308707d8f5ed17e782f86afe6800c73112bf8706829b52fa2a8c9d7528a361b","observation_id":"12ec3800-2704-4bd4-a5a2-56b77f154a14","resolution":{"observed_at":"2026-05-13T06:35:13.433785Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.11805","last_updated":"2025-05-09T21:04:06Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-12-19T02:39:27Z","title":"Gemini: A Family of Highly Capable Multimodal Models","version":5},"cited_work":{"arxiv_id":"2312.11805","doi":"10.1038/nrn2888","metadata_source":"pith","pith_arxiv_id":"2312.11805","snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"Gemini: A Family of Highly Capable Multimodal Models","venue":"cs.CL","work_id":"83f7c85b-3f11-450f-ac0c-64d9745220b2","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2312.11805","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:42683c4253ddc4fc7d0b8a03738a1d4290b84a270ee8257c47891e153950009a","observation_id":"fdf395f8-aedb-4dad-b473-2a9e770a712b","resolution":{"observed_at":"2026-05-13T06:35:13.440104Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"status/1569128","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Exploiting GPT-3 prompts with malicious inputs that order the model to ignore its previous directions","venue":null,"work_id":"859007b0-327d-46b2-8cd6-0799c830dc24","year":2022},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:382c2fd7915fecbeab5751942e83083c9b6d1afed8cd304f5d0c8a7670b59e0d","observation_id":"a6680ea7-a0bb-477f-be13-578cd47e3483","resolution":{"observed_at":"2026-05-13T06:35:13.445172Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1145/3605764","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-29T18:43:50.236894Z","title":"Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","venue":null,"work_id":"ed1c36b7-5539-4218-a404-25ad357e7aa4","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:ad7f30011ab1cab67955d54bcce96161919eb8549aacc710ae2cc88b737fcdb9","observation_id":"b763d4c3-75d6-4655-ba2a-66aced532e98","resolution":{"observed_at":"2026-05-13T06:35:13.381921Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14720","last_updated":"2024-03-20T15:26:23Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-20T15:26:23Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","version":1},"cited_work":{"arxiv_id":"2403.14720","doi":"10.48550/arxiv.2403.14720","metadata_source":"pith","pith_arxiv_id":"2403.14720","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","venue":"cs.CR","work_id":"c18cd975-e731-4e0f-a99f-a37d846cdd31","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2403.14720","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:0f689cbbee83ffefd02b558055a4852acae73d75cc20d8c947179089f8e19fa9","observation_id":"3b16a231-0ac6-4ecf-8d37-faf42f5e381c","resolution":{"observed_at":"2026-05-14T22:28:55.556742Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Language models as zero-shot planners: Extracting actionable knowledge for embodied agents","venue":null,"work_id":"d738532f-9248-4a68-916e-12ebcff21801","year":2022},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:257eeddc96a45b6c231c0f61b86ca0d0a02f87e81efcc3c3cab001f997a26405","observation_id":"ff004233-d55a-4973-8215-430a69a41b80","resolution":{"observed_at":"2026-05-13T06:35:13.601636Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Llama-3 Function Calling Demo","venue":null,"work_id":"92251cc0-d2e5-466d-97fb-ec50b3be41ff","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:87114bfc6fd016fd881ec060d70c2825618355e2157e3b4313677b0839311039","observation_id":"0d533d86-bf1d-4c7c-bfcc-6eded8f0ef3e","resolution":{"observed_at":"2026-05-13T06:35:13.604039Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Function calling","venue":null,"work_id":"0b9e9d95-91a8-4014-86a3-303994aaeb4a","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:c7e1df3f991790bb436b0578af464ebc7bc61a23593eedf2655fd22d955ab403","observation_id":"138936e7-ea59-42ce-932d-4a29faf02673","resolution":{"observed_at":"2026-05-13T06:35:13.607156Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Exploiting programmatic behavior of llms: Dual-use through standard security attacks","venue":null,"work_id":"8918fadf-e8c8-43d4-927d-4952e196f64f","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:a93fcdc806bdc798fd0052ba7eb225d9c2aef6a8d5c38a2ea98eef1af768f473","observation_id":"a189a154-10b5-4c98-96f6-eb1403e05e07","resolution":{"observed_at":"2026-05-13T06:35:13.609711Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Intro to Large Language Models","venue":null,"work_id":"f1de7116-5955-4c96-8d66-8d734bf28006","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:741484b11e81f593d7ec67fb655c9e4f2622c99fb1230adc90e8cd7c42cc9ec3","observation_id":"7ed3ebfc-7c53-439f-8f8d-1111e6f3edfd","resolution":{"observed_at":"2026-05-13T06:35:13.612081Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Language models can solve computer tasks","venue":null,"work_id":"baf9115c-6423-431b-8931-ea7358589c06","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:75d6a751461ce9abf4b24e24532388570070db2ab624823a847d12b4c832ca71","observation_id":"28c6a111-7d60-40ef-be71-70a005878f26","resolution":{"observed_at":"2026-05-13T06:35:13.614409Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.11671","last_updated":"2024-01-04T18:46:39Z","snapshot_observed_at":"2026-07-06T17:04:54.448866Z","submitted_at":"2023-12-18T19:27:09Z","title":"Evaluating Language-Model Agents on Realistic Autonomous Tasks","version":2},"cited_work":{"arxiv_id":"2312.11671","doi":"10.48550/arxiv.2312.11671","metadata_source":"arxiv_reference","pith_arxiv_id":"2312.11671","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"Evaluating language-model agents on realistic autonomous tasks","venue":null,"work_id":"7c45ae0e-510a-4bc0-ab18-ca357a0507c2","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2312.11671","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:23c3a275c3c1dbf24a45187f64c021d09e733138d8094199943a8dac8d175165","observation_id":"e7ee29c8-aa5f-43a1-9aa4-247e47cd87ce","resolution":{"observed_at":"2026-05-13T06:35:13.377228Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:37.750386+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:37.750386+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Large language models are zero-shot reasoners","venue":null,"work_id":"530df76e-becd-4d9c-a095-803591d02ae5","year":2022},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:80ef609a7cb5172dc7ec3fe426b46f629966aee377e39524e8b302b288ab0ad8","observation_id":"b4b20713-a35c-42fe-914b-b8452d7f2ab6","resolution":{"observed_at":"2026-05-13T06:35:13.619634Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"ChainGuard","venue":null,"work_id":"e885dae1-a344-4c3c-9ec7-670a51309657","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:c40f994f3cec5b168635d5c3e66790f77365d54068e862ac6c1c05bdb5130f47","observation_id":"6a9d5bf3-1b0b-4dae-9ab2-beeffbec5364","resolution":{"observed_at":"2026-05-13T06:35:13.621884Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Hugging Face prompt injection identification","venue":null,"work_id":"f61cb7d9-f063-4846-ba1b-2f51909f959f","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:e7ed49a6c9f8eccb50ad37099645c94d22ade45b3d17ff296ba273b755433e93","observation_id":"050c8764-3496-440f-ae57-2db65fe39050","resolution":{"observed_at":"2026-05-13T06:35:13.624340Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Sandwich Defense","venue":null,"work_id":"b206c735-d26d-42ac-a09e-c6291504ab17","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:44b67feee061ecee18d285a83dc0c3def1d295dc3a4576fcdafc6cc205121329","observation_id":"0ddc7093-f791-4aba-b399-9ff46ed3d8f5","resolution":{"observed_at":"2026-05-13T06:35:13.626533Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2308.04026","last_updated":"2023-08-08T03:59:28Z","snapshot_observed_at":"2026-07-06T16:03:46.860343Z","submitted_at":"2023-08-08T03:59:28Z","title":"AgentSims: An Open-Source Sandbox for Large Language Model Evaluation","version":1},"cited_work":{"arxiv_id":"2308.04026","doi":"10.48550/arxiv.2308.04026","metadata_source":"pith","pith_arxiv_id":"2308.04026","snapshot_observed_at":"2026-07-10T20:47:34.513696Z","title":"Agentsims: An open-source sandbox for large language model evaluation","venue":"cs.AI","work_id":"55089abe-3741-4e0b-aa1f-690b84807d21","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2308.04026","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:d7019548780e25fab07bf2cc0c547f8f98b91493f87f6690f69c70e59a0351a7","observation_id":"5fa1c041-6c39-4105-a389-8048cc188233","resolution":{"observed_at":"2026-05-13T06:35:13.453486Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2308.03688","last_updated":"2025-10-04T03:54:18Z","snapshot_observed_at":"2026-08-04T04:48:34.061129Z","submitted_at":"2023-08-07T16:08:11Z","title":"AgentBench: Evaluating LLMs as Agents","version":3},"cited_work":{"arxiv_id":"2308.03688","doi":"10.1109/fllm63129.2024.10852426","metadata_source":"pith","pith_arxiv_id":"2308.03688","snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"AgentBench: Evaluating LLMs as Agents","venue":"cs.AI","work_id":"a37549b4-4c94-412d-acc4-4efeb08509be","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2308.03688","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:d16995cd87527633a16f8ff7057ce75b4c5c115c1a60ab980728c52bcbbc41df","observation_id":"dd6ace60-0919-4fb1-a14f-3b02003d9500","resolution":{"observed_at":"2026-05-13T06:35:13.457513Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05499","last_updated":"2025-12-29T02:25:27Z","snapshot_observed_at":"2026-07-06T15:40:27.639368Z","submitted_at":"2023-06-08T18:43:11Z","title":"Prompt Injection attack against LLM-integrated Applications","version":3},"cited_work":{"arxiv_id":"2306.05499","doi":"10.48550/arxiv.2306.05499","metadata_source":"pith","pith_arxiv_id":"2306.05499","snapshot_observed_at":"2026-07-11T02:47:49.696576Z","title":"Prompt Injection attack against LLM-integrated Applications","venue":"cs.CR","work_id":"977b4683-bba6-49d6-8f3d-496c41cb7fac","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2306.05499","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:57293fb3c6aac825f08bc7b303c05c7a1df8c41a7abfc5667b9675d2a4868e0a","observation_id":"30dad74b-8226-46c6-9624-10bb0e3faa27","resolution":{"observed_at":"2026-05-13T06:35:13.461945Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2310.12815","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T13:39:51.347043Z","title":"Prompt Injection Attacks and Defenses in LLM-Integrated Applications","venue":null,"work_id":"1c84b454-fc78-4b84-b1bb-fe6e99425630","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:0bd8b4f5979471ff666ebc0841ba315a81b52828362b6f20bbbb7028eb2eb1e4","observation_id":"6eb7b17d-a90c-4fc2-8414-37f5a5c48b69","resolution":{"observed_at":"2026-05-13T06:35:13.467174Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Chameleon: Plug-and-play compositional reasoning with large language models","venue":null,"work_id":"70b91db9-7950-4411-9eea-b4ca06baa10f","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:f536dbe640314ecebc5a7b40cfb5790b4d4b28da0a8cee7215eb82ba9ee085d9","observation_id":"12afe5fa-cf85-45a8-87ad-3757a169b0a7","resolution":{"observed_at":"2026-05-13T06:35:13.637864Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.04249","last_updated":"2024-02-27T04:43:08Z","snapshot_observed_at":"2026-07-06T17:26:23.067923Z","submitted_at":"2024-02-06T18:59:08Z","title":"HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal","version":2},"cited_work":{"arxiv_id":"2402.04249","doi":"10.48550/arxiv.2402.04249","metadata_source":"pith","pith_arxiv_id":"2402.04249","snapshot_observed_at":"2026-07-10T15:27:20.028353Z","title":"HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal","venue":"cs.LG","work_id":"b0b0303f-2444-4789-a979-8153624312ff","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2402.04249","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:11a2a856ac9aa7a10acf851c59848ef02a401f18380c8048e581a0977cd39d1f","observation_id":"736089f3-4a8e-4705-afe9-7c96d906784d","resolution":{"observed_at":"2026-05-13T06:35:13.472307Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Inverse Scaling Prize: Second Round Winners","venue":null,"work_id":"c3f51d72-20d3-4a5b-9ee5-6f0a6e140ddc","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:b7483c02facf7110101b0fcc6f2ac62909dd1d9db6194b81064aa214193ccf98","observation_id":"c6b2f7b9-6de7-48bc-8196-3b7866750f79","resolution":{"observed_at":"2026-05-13T06:35:13.642480Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.09479","last_updated":"2024-05-13T01:25:12Z","snapshot_observed_at":"2026-08-03T07:23:04.207005Z","submitted_at":"2023-06-15T20:11:23Z","title":"Inverse Scaling: When Bigger Isn't Better","version":2},"cited_work":{"arxiv_id":"2306.09479","doi":null,"metadata_source":"pith","pith_arxiv_id":"2306.09479","snapshot_observed_at":"2026-07-05T18:51:18.126997Z","title":"Inverse scaling: When bigger isn’t better","venue":"cs.CL","work_id":"1c008e29-d0ea-4a25-9792-4d3a8eb7d7b4","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2306.09479","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:971adf9aabdc211b56096dfb531a9772bff33a10c68dfcc1e244bfcc6a5e23b2","observation_id":"8ed30a97-a648-4d9a-b493-5215ca33d997","resolution":{"observed_at":"2026-05-13T06:35:13.477819Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.04235","last_updated":"2024-03-08T17:04:49Z","snapshot_observed_at":"2026-07-06T16:44:23.357719Z","submitted_at":"2023-11-06T08:50:29Z","title":"Can LLMs Follow Simple Rules?","version":3},"cited_work":{"arxiv_id":"2311.04235","doi":"10.48550/arxiv.2311.04235","metadata_source":"arxiv_reference","pith_arxiv_id":"2311.04235","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"Can LLMs follow simple rules?arXiv preprint arXiv:2311.04235","venue":null,"work_id":"1a141f91-f3c6-4733-ab33-e7611c062cc6","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2311.04235","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:74c24e9f5cbb13b2a3cfbb0a4a2e1db733e9e37d905b246c745b71e7dec5fa6c","observation_id":"6907c167-55b2-40a6-b898-a276972b3309","resolution":{"observed_at":"2026-05-13T06:35:13.482038Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2112.09332","last_updated":"2022-06-01T19:08:11Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2021-12-17T05:43:43Z","title":"WebGPT: Browser-assisted question-answering with human feedback","version":3},"cited_work":{"arxiv_id":"2112.09332","doi":"10.48550/arxiv.2112.09332","metadata_source":"pith","pith_arxiv_id":"2112.09332","snapshot_observed_at":"2026-07-10T13:57:07.005292Z","title":"WebGPT: Browser-assisted question-answering with human feedback","venue":"cs.CL","work_id":"e25ef3e1-4848-4cb9-bf28-67a420591165","year":2021},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2112.09332","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:31233a91e2ad899447f078676e28c815868cee13328ed4b77bc0433984610c3a","observation_id":"6ad776cf-7741-4bac-a374-4dc961fa27fd","resolution":{"observed_at":"2026-05-13T06:35:13.485984Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T01:08:09.995583+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-04T01:08:09.995583+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Training language models to follow instructions with human feedback","venue":null,"work_id":"ee3a4395-000e-4e21-b9c8-3fc2f0024a8a","year":2022},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:e539887aa87d36fd57a5fcf7733d0c6190f55dd050fc65bada5d8a193a8af48d","observation_id":"17793c88-76f3-495f-8f74-5c0e4eab2097","resolution":{"observed_at":"2026-05-13T06:35:13.547002Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.03792","last_updated":"2024-05-02T09:25:38Z","snapshot_observed_at":"2026-07-06T17:40:29.558340Z","submitted_at":"2024-03-06T15:40:30Z","title":"Neural Exec: Learning (and Learning from) Execution Triggers for Prompt Injection Attacks","version":2},"cited_work":{"arxiv_id":"2403.03792","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2403.03792","snapshot_observed_at":"2026-07-03T06:17:41.932219Z","title":"Neu- ral exec: Learning (and learning from) execution triggers for prompt injection attacks","venue":null,"work_id":"47349134-5f8f-469c-b2b0-eabf8e389cd2","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2403.03792","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:66186ff660491c858a2c8afe3460e6a69e98ac3cb59bd1221edcc4b191ec3f8b","observation_id":"c79b8249-09cf-4b2b-b2aa-d2490ca9d575","resolution":{"observed_at":"2026-05-13T06:35:13.490917Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2305.15334","last_updated":"2023-05-24T16:48:11Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-05-24T16:48:11Z","title":"Gorilla: Large Language Model Connected with Massive APIs","version":1},"cited_work":{"arxiv_id":"2305.15334","doi":"10.48550/arxiv.2305.15334","metadata_source":"pith","pith_arxiv_id":"2305.15334","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"Gorilla: Large Language Model Connected with Massive APIs","venue":"cs.CL","work_id":"126a464a-4a73-495f-b669-de1e44aa8f09","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2305.15334","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:5c8894371feb020a1f8d174d252fe41273cc721a3a6a3836809927e734969b81","observation_id":"f75b22c9-ef3d-467a-a0bb-45ced0536cb7","resolution":{"observed_at":"2026-05-13T06:35:13.494151Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2211.09527","last_updated":"2022-11-17T13:43:20Z","snapshot_observed_at":"2026-07-06T14:19:47.424778Z","submitted_at":"2022-11-17T13:43:20Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","version":1},"cited_work":{"arxiv_id":"2211.09527","doi":"10.48550/arxiv.2211.09527","metadata_source":"pith","pith_arxiv_id":"2211.09527","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","venue":"cs.CL","work_id":"a7c5b6ec-3407-4330-96c8-3fc58e7d410b","year":2022},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2211.09527","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:55bafc190a034495df9f62a493b19571469aeb64b30ae0225dedcccd7f06ca45","observation_id":"5dfd70e5-a53e-40c3-9ec5-86eb0a112b5f","resolution":{"observed_at":"2026-05-13T06:35:13.497861Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-05-24T11:53:03.018758+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-24T11:53:03.018758+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Fine-Tuned DeBERTa-v3-base for Prompt Injection Detection","venue":null,"work_id":"b2f625e8-bcbb-476a-ab3a-ec6a3b8f7b67","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:ebea4766e4c6039247477b31c843969e35c6eaf64620190632b5dedd90375a42","observation_id":"d9c2dd97-c24c-4792-be2e-8890fdacc08e","resolution":{"observed_at":"2026-05-13T06:35:13.558050Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1145/3531146","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Ferrario and M","venue":null,"work_id":"c045fd07-6c84-470a-a746-ae6af10d2626","year":2022},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:f51aa6d87150b52225aeaf63913d586456e63ef2aab3994ce7287a51a0558f69","observation_id":"4d94d931-6d7c-465d-a0f1-6de64f232b37","resolution":{"observed_at":"2026-05-13T06:35:13.371446Z","resolver_source":"doi","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T20:20:48.911581+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T20:20:48.911581+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.16789","last_updated":"2023-10-03T14:45:48Z","snapshot_observed_at":"2026-07-06T16:00:46.542753Z","submitted_at":"2023-07-31T15:56:53Z","title":"ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIs","version":2},"cited_work":{"arxiv_id":"2307.16789","doi":"10.48550/arxiv.2307.16789","metadata_source":"pith","pith_arxiv_id":"2307.16789","snapshot_observed_at":"2026-07-10T13:37:06.789691Z","title":"ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIs","venue":"cs.AI","work_id":"3c555b48-a4d9-42dd-9fdd-0f6018fbe9cb","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2307.16789","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:e3f88126f948e0ff912ce1bf6c5322890773469fd638570cc84166b96e65be8c","observation_id":"dc77fb29-ad00-4364-9971-134b47951aef","resolution":{"observed_at":"2026-05-13T06:35:13.501925Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-12T03:19:33.730697+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-12T03:19:33.730697+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"9221a70a-c578-43f6-954f-f69078315114","year":null},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:d6b9e0a3ee486a1ad2cfca899ffe1f4f95376c7a1ea02b16b814a25f59cc8404","observation_id":"4d3d63fc-fd61-4acf-a028-da7e60fe01bf","resolution":{"observed_at":"2026-05-13T06:35:13.567218Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2205.06175","last_updated":"2022-11-11T10:04:29Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-05-12T16:03:26Z","title":"A Generalist Agent","version":3},"cited_work":{"arxiv_id":"2205.06175","doi":"10.48550/arxiv.2205.06175","metadata_source":"pith","pith_arxiv_id":"2205.06175","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"A Generalist Agent","venue":"cs.AI","work_id":"4b0a87cd-8d54-4abc-9698-c4cb20995600","year":2022},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2205.06175","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:f13a7af278a8c72da09137e5dc2ce412249ec7d931eca7715f5902e6d7d15001","observation_id":"f765be89-858b-471a-8308-8b3fffea7e77","resolution":{"observed_at":"2026-05-13T06:35:13.505440Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Identifying the Risks of LM Agents with an LM-Emulated Sandbox","venue":null,"work_id":"65ebbc97-2cbe-4f31-b557-8b33b489de8c","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:bccd08a682815be374ca03e3c10458dab4ada73b6d53559829de4af03c550a0b","observation_id":"cbed452d-a5ad-46f9-971b-b3220c1daf39","resolution":{"observed_at":"2026-05-13T06:35:13.574124Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"ToolFormer: Language Models Can Teach Themselves to Use Tools","venue":null,"work_id":"6edf9c32-32f6-4de0-8760-8112c3e68633","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:381ea771cc89d5a36680ec5ea72756f67448c44651d2960e651f5f1a07126ae6","observation_id":"67787891-3bed-47a3-ad4f-b623d37cbddc","resolution":{"observed_at":"2026-05-13T06:35:13.577911Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs Through a Global Prompt Hacking Competition","venue":null,"work_id":"9b5e268c-68f6-4818-aa24-226fed902ea6","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:090e2b4f5be5c86d4ae343629e966bc17a620962877eb7788cc6ffaf883ba279","observation_id":"a36945c7-8084-4c47-8bb5-6035b5581c55","resolution":{"observed_at":"2026-05-13T06:35:13.580632Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"HuggingGPT: Solving AI tasks with ChatGPT and its friends in Hugging Face","venue":null,"work_id":"c06ec01b-210e-487e-a4eb-3dba3d5323b6","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:53a1cb062539fc245ad70f1d300dffd98b53ec36e935125524b6322550f9610b","observation_id":"4633d987-49ba-4ef0-bd71-d006c2155764","resolution":{"observed_at":"2026-05-13T06:35:13.585862Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05301","last_updated":"2023-09-07T12:20:45Z","snapshot_observed_at":"2026-07-06T15:40:20.267344Z","submitted_at":"2023-06-08T15:46:32Z","title":"ToolAlpaca: Generalized Tool Learning for Language Models with 3000 Simulated Cases","version":2},"cited_work":{"arxiv_id":"2306.05301","doi":"10.48550/arxiv.2306.05301","metadata_source":"pith","pith_arxiv_id":"2306.05301","snapshot_observed_at":"2026-07-10T16:57:24.528783Z","title":"ToolAlpaca: Generalized Tool Learning for Language Models with 3000 Simulated Cases","venue":"cs.CL","work_id":"e900f660-9178-4fda-ad54-a788e23aa0d8","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2306.05301","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:01b9f342d11bf7dc80839b7b097505a8f57ee38f3cc447b3f343b2562e50ef75","observation_id":"887aa387-3fc8-4522-a27c-33ab572c08c7","resolution":{"observed_at":"2026-05-15T23:03:48.638764Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2201.08239","last_updated":"2022-02-10T16:30:11Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-01-20T15:44:37Z","title":"LaMDA: Language Models for Dialog Applications","version":3},"cited_work":{"arxiv_id":"2201.08239","doi":"10.48550/arxiv.2201.08239","metadata_source":"pith","pith_arxiv_id":"2201.08239","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"LaMDA: Language Models for Dialog Applications","venue":"cs.CL","work_id":"1b66d0a5-f6ae-4332-8025-c662dc64b238","year":2022},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2201.08239","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:063ee7bb02d0781fb784e40230a52951d31c2ca77cf0efa7c19730f11dd566a7","observation_id":"67799eab-511e-4e91-bdc8-87f06455f885","resolution":{"observed_at":"2026-05-13T06:35:13.513112Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2302.13971","last_updated":"2023-02-27T17:11:15Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-02-27T17:11:15Z","title":"LLaMA: Open and Efficient Foundation Language Models","version":1},"cited_work":{"arxiv_id":"2302.13971","doi":"10.48550/arxiv.2302.13971","metadata_source":"pith","pith_arxiv_id":"2302.13971","snapshot_observed_at":"2026-07-11T03:47:48.508181Z","title":"LLaMA: Open and Efficient Foundation Language Models","venue":"cs.CL","work_id":"c018fc23-6f3f-4035-9d02-28a2173b2b9d","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2302.13971","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:f1e831472251a46c0a465b8ed4ef514e36c715fefd1cbe7b3ee686cdac6c81d5","observation_id":"5e82e77e-880e-4956-af17-92b4028e3c91","resolution":{"observed_at":"2026-05-13T06:35:13.516678Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-01T11:08:05.851253+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-01T11:08:05.851253+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.01011","last_updated":"2023-11-02T06:13:36Z","snapshot_observed_at":"2026-07-06T16:42:04.139453Z","submitted_at":"2023-11-02T06:13:36Z","title":"Tensor Trust: Interpretable Prompt Injection Attacks from an Online Game","version":1},"cited_work":{"arxiv_id":"2311.01011","doi":"10.48550/arxiv.2311.01011","metadata_source":"arxiv_reference","pith_arxiv_id":"2311.01011","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"”Tensor trust: Interpretable prompt injection attacks from an online game.” arXiv preprint arXiv:2311.01011 (2023)","venue":null,"work_id":"2c485010-a490-4283-8a00-55d8996962a4","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2311.01011","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:c23cf86b096bf2a791e0438c2449d83e8432d34d59d15d75aa08bcb6394fc87f","observation_id":"d629e88a-7f94-45c8-ac53-8a0ce87dc0db","resolution":{"observed_at":"2026-05-13T06:35:13.366955Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"On Adaptive Attacks to Adversarial Example Defenses","venue":null,"work_id":"13f14c1b-8267-4f7b-86cf-06bf5be33017","year":2020},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:f543dae256a245e7a5b6a98285e04bd264aba40b8428ddec069a62f0460fd5cf","observation_id":"a41e7317-49bb-463a-bdeb-3ae0ea4a3a4f","resolution":{"observed_at":"2026-05-13T06:35:13.631216Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-02T11:48:17.206729Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":"2404.13208","doi":"10.48550/arxiv.2404.13208","metadata_source":"pith","pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-07-10T12:27:04.237600Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","venue":"cs.CR","work_id":"ba941a96-eb3b-48c0-b52c-5e9463085190","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:83fd6fa12fe7eed455c332b3b3d8b8b6df78122d8b745b382e97511b138504e9","observation_id":"8d3e5858-2051-4112-8d0f-b8ac2c59bee8","resolution":{"observed_at":"2026-05-13T06:35:13.520049Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Chain-of-thought prompting elicits reasoning in large language models","venue":null,"work_id":"82931696-08fa-41d5-b4c0-4ec70a23ba6b","year":2022},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:b00375d877f90ec988ec682a1976aaf905029f725ddf925f327b64798c7c7f05","observation_id":"f8a2b545-9b39-419f-ad4f-9dcc330bebf8","resolution":{"observed_at":"2026-05-13T06:35:13.635669Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Delimiters won’t save you from prompt injection","venue":null,"work_id":"50f67b7c-3910-4bdc-96c5-5be7e7df2ad3","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:622201e098d66959807aa457db5fbc2ab7f11956156f8f28e7aa6021fd80bfc7","observation_id":"b8cc1885-0c6b-4555-9f1d-8136a9ccaaa8","resolution":{"observed_at":"2026-05-13T06:35:13.640044Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Prompt injection attacks against GPT-3","venue":null,"work_id":"d4f71d40-5b7c-4fee-ac7f-c02c45f1c9f7","year":2022},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:c81712702ff974a07cae220e65de5621184e12c37a032ff859b90a1e9c828dea","observation_id":"15a0d934-0313-498b-b3a9-f15a484617e5","resolution":{"observed_at":"2026-05-13T06:35:13.644608Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"The Dual LLM pattern for building AI assistants that can resist prompt injection","venue":null,"work_id":"5190f29c-538a-47b6-bd15-90b620796d47","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:bd2fc9d3286c4e66476d3906b7f06bf14bd2ac23cfe2f7d66eb4e8bae8c48ffd","observation_id":"31887075-db0a-4631-8a2b-e037ff304695","resolution":{"observed_at":"2026-05-13T06:35:13.646857Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"You can’t solve AI security problems with more AI","venue":null,"work_id":"8d3792ba-0d71-40a3-898a-274b4e231b12","year":2022},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:5e7317fa33cb03694ff9adf9d1f8339f2635b1b1584268e3ba94a1b0fdb556ac","observation_id":"6760c282-5a9e-48b2-b330-912bfc12d9fa","resolution":{"observed_at":"2026-05-13T06:35:13.649080Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Intelligent agents: Theory and practice","venue":null,"work_id":"39e0185e-0b2c-4779-a33c-75ea23a31ebd","year":1995},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:dcdf26909eddf9bdbddab970c149ed1ac4ec84c4eec18b0bc62357b716d3163a","observation_id":"d8053d49-8ffc-46f4-b6b1-78c150ca985b","resolution":{"observed_at":"2026-05-13T06:35:13.549711Z","resolver_source":"raw_fallback","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.04960","last_updated":"2025-01-30T22:55:18Z","snapshot_observed_at":"2026-08-03T16:57:10.185196Z","submitted_at":"2024-03-08T00:02:30Z","title":"IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems","version":2},"cited_work":{"arxiv_id":"2403.04960","doi":null,"metadata_source":"pith","pith_arxiv_id":"2403.04960","snapshot_observed_at":"2026-07-11T02:47:50.122545Z","title":"SecGPT: An Execution Isolation Architecture for LLM-Based Systems","venue":"cs.CR","work_id":"b8650c23-e9e9-4d99-83d1-87e2dec8898b","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2403.04960","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:7a656bddcf49fd9e10de103973ba6f7407164038ebea05a12f234c0f1718117e","observation_id":"2c8c0462-de83-4073-b1a6-a6feb0b957b0","resolution":{"observed_at":"2026-05-13T06:35:13.524586Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Patil, Ion Stoica, and Joseph E","venue":null,"work_id":"1bdf5aba-ff0f-4b65-b7b8-8fc01ffbbf76","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:499dbd2341e78c8418dbcfc4875aa1f3084156fe3351eaa1e5e69d1528fa2c31","observation_id":"b47c137a-096a-4e30-a15a-ed0c5a4f26d1","resolution":{"observed_at":"2026-05-13T06:35:13.554968Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"WebShop: Towards scal- able real-world web interaction with grounded language agents","venue":null,"work_id":"f710fcde-77e1-4152-aeaa-440735e8834b","year":2022},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:1a2eab6f723140eb312389a87fb29173685c8c4e9523b0a096ec6d3a1c21f5fd","observation_id":"3f9d2a67-f999-4b00-a600-dc1e8e5606e6","resolution":{"observed_at":"2026-05-13T06:35:13.564496Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2210.03629","last_updated":"2023-03-10T01:00:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-10-06T01:00:32Z","title":"ReAct: Synergizing Reasoning and Acting in Language Models","version":3},"cited_work":{"arxiv_id":"2210.03629","doi":"10.48550/arxiv.2210.03629","metadata_source":"pith","pith_arxiv_id":"2210.03629","snapshot_observed_at":"2026-07-11T03:47:47.842265Z","title":"ReAct: Synergizing Reasoning and Acting in Language Models","venue":"cs.CL","work_id":"407a2351-25f1-497d-b611-f77d0292a8e6","year":2022},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2210.03629","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:37b4e2662a0fc5ae022ed8452fb41b26c1269cf644f8add91996e17e2efaed9f","observation_id":"b2e74fb0-7a93-444d-a374-5196be604bfa","resolution":{"observed_at":"2026-05-13T06:35:13.528496Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-12T03:19:36.897515+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-12T03:19:36.897515+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.14197","last_updated":"2025-01-27T08:51:16Z","snapshot_observed_at":"2026-07-06T17:06:45.522731Z","submitted_at":"2023-12-21T01:08:39Z","title":"Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models","version":4},"cited_work":{"arxiv_id":"2312.14197","doi":"10.48550/arxiv.2312.14197","metadata_source":"arxiv_reference","pith_arxiv_id":"2312.14197","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"Benchmarking and defending against indirect prompt injection attacks on large language models","venue":null,"work_id":"0a458c42-fb17-4655-82ad-c93057550c76","year":2025},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2312.14197","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:84bb1a7b1ab727724df2d0576ea1ca5866e80fd6375a6b8ba284bfa3c1fc9d71","observation_id":"d352e1af-4809-454a-9774-144f23f1472d","resolution":{"observed_at":"2026-05-13T06:35:13.402235Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02691","last_updated":"2024-08-04T04:52:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-05T06:21:45Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","version":3},"cited_work":{"arxiv_id":"2403.02691","doi":"10.1145/3696410.3714756","metadata_source":"pith","pith_arxiv_id":"2403.02691","snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","venue":"cs.CL","work_id":"5cbfcda4-ec26-44e4-be60-e1525956d71d","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2403.02691","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:ae7b24f57ad39d6e09331e6f6aacdb391f42653c55227b171cb88724136d3157","observation_id":"9c6125cb-c32d-4627-b5f7-f8ea00afff5d","resolution":{"observed_at":"2026-05-13T21:40:06.567267Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.13854","last_updated":"2024-04-16T15:13:18Z","snapshot_observed_at":"2026-07-06T15:58:31.756298Z","submitted_at":"2023-07-25T22:59:32Z","title":"WebArena: A Realistic Web Environment for Building Autonomous Agents","version":4},"cited_work":{"arxiv_id":"2307.13854","doi":"10.48550/arxiv.2307.13854","metadata_source":"pith","pith_arxiv_id":"2307.13854","snapshot_observed_at":"2026-07-10T14:17:10.112759Z","title":"WebArena: A Realistic Web Environment for Building Autonomous Agents","venue":"cs.AI","work_id":"7058ffd2-a339-4102-89eb-248eeb074652","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2307.13854","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:52f252dc18f6f3a786e2b8f26e1999693faf9e509e0f6e76442ee2efde3f1d5a","observation_id":"fee48bd9-05a6-47d3-b79d-f6d61876a178","resolution":{"observed_at":"2026-05-13T06:35:13.536309Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-05-20T18:52:18.85917+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-20T18:52:18.85917+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":"2307.15043","doi":"10.48550/arxiv.2307.15043","metadata_source":"pith","pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-07-11T02:47:49.837877Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","venue":"cs.CL","work_id":"3322fa86-1768-4677-8425-dd326b45e078","year":2023},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:d39198c5d07de7678b45369f655c525b925d3a08f33152583ab317439d696e6c","observation_id":"d9c4eff1-78e4-4d0c-af2c-c8aeac3843c4","resolution":{"observed_at":"2026-05-13T06:35:13.539981Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T23:50:40.271168+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T23:50:40.271168+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.06833","last_updated":"2025-01-31T16:06:52Z","snapshot_observed_at":"2026-07-06T17:42:41.349428Z","submitted_at":"2024-03-11T15:48:56Z","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","version":3},"cited_work":{"arxiv_id":"2403.06833","doi":"10.48550/arxiv.2403.06833","metadata_source":"arxiv_reference","pith_arxiv_id":"2403.06833","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"Can llms separate instructions from data? and what do we even mean by that?","venue":null,"work_id":"714da9a8-c412-4caf-9c48-7c8dfe5cf10e","year":2025},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2403.06833","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:4d85c9460143950fcdc07143afb8de634461ab10ac19324057c6c4d00b91243b","observation_id":"46fec84a-dbcb-4e7e-8d3f-a40d8fa35f43","resolution":{"observed_at":"2026-05-13T06:35:13.544043Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"4fd261da-fdf2-410a-994b-c8a32dba54a3","year":null},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:f5350dcefd277c45f531772013d7a90c026a4ba1cd6690c8a2179803a6bda8d5","observation_id":"cb002e5c-9137-4add-94ef-121f102afae4","resolution":{"observed_at":"2026-05-13T06:35:13.570361Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"(a) Did you state the full set of assumptions of all theoretical results? [N/A] (b) Did you include complete proofs of all theoretical results? [N/A]","venue":null,"work_id":"ae0447d1-dd72-4adf-a573-6ec340117941","year":null},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:c96d4c11e73bc6320e7b89689439509223e1cd0764deb0f43019da0aa5eb2d38","observation_id":"bcde0b29-840d-4b87-b504-05f4e1289ca4","resolution":{"observed_at":"2026-05-13T06:35:13.592558Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"for benchmarks)","venue":null,"work_id":"a3c96f17-72da-4f7a-95a3-00d1697a59f2","year":null},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:4c635d109da4cbe742733b62e27148c505dabb6a83624b45df1add2b41e86753","observation_id":"bcd0b5f9-639c-4471-9923-75e36162c586","resolution":{"observed_at":"2026-05-13T06:35:13.598808Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"839e8f8b-cee4-41af-8009-8902d68a6548","year":null},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:5c976362b1274f3a0aa10e294716169ac4db1ed3b429be5ef8fe0327b6012d70","observation_id":"98b07d70-0cd8-4967-ac2a-441b327b959a","resolution":{"observed_at":"2026-05-13T06:35:13.633403Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.5281/zenodo.12528188","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Send the Facebook security code received via email from security@fb.com to eve@mail.com","venue":null,"work_id":"fc674b59-924b-4279-a45f-7c522bb8ac1c","year":2024},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:af6c08d1f628b830f5fa3ec57a84544d31e023eb6718c55a0815f00e303224d3","observation_id":"1fb1e9cf-c268-4ec1-9567-ba60880d251f","resolution":{"observed_at":"2026-05-13T06:35:13.390601Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","latest_version":3,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents"},"reference_resolution":{"displayed":79,"state_counts":{"malformed_identifier":1,"metadata_mismatch":3,"parse_uncertain":0,"unresolved":3,"verified_exact":37,"verified_fuzzy":35},"total_outbound_references":79},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"thesis":"As of 5 August 2026, this Paper Citation Record lists 79 of 79 outbound references and 96 inbound Pith citation observations for arXiv:2406.13352."}