{"as_of":"2026-08-08T12:09:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:272e1c58adb63d34fdc03f1245c2b702482221a53ff148e9856bc8b395c6aafc","coverage":[{"denominator":0,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":22,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":22,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-08T06:32:00.761636+00:00","state":"measured"},{"denominator":22,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":22,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-08T04:37:28.833682Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-05-19T11:32:17.399819Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":"2407.20859","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":"5d974f12-7aa9-48ab-91d4-b739092384cb","year":2024},"citing_paper":{"arxiv_id":"2410.07283","last_updated":"2024-10-09T11:01:29Z","snapshot_observed_at":"2026-08-02T17:12:52.352951Z","submitted_at":"2024-10-09T11:01:29Z","title":"Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems","version":1},"reference_index":92,"source":"arxiv_source","source_observed_at":"2026-05-15T19:32:19.405615Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2410.07283"},"observation_digest":"sha256:a27cdbac2b565b80f51d908528d7bc5f7d41341faafaeafa06619d57281c1ee8","observation_id":"70567d79-fc90-402b-9b4a-faed101ddead","resolution":{"observed_at":"2026-05-15T19:32:19.842883Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":"2407.20859","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":"5d974f12-7aa9-48ab-91d4-b739092384cb","year":2024},"citing_paper":{"arxiv_id":"2410.09024","last_updated":"2025-04-18T14:30:31Z","snapshot_observed_at":"2026-08-02T12:38:54.249632Z","submitted_at":"2024-10-11T17:39:22Z","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","version":3},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-05-14T01:35:50.992477Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2410.09024"},"observation_digest":"sha256:4d3624e1c68d341d8118b0724013ea11444f464ea93b79a28c2326507d56c117","observation_id":"27868dea-37aa-466f-a614-86f0fb11dd28","resolution":{"observed_at":"2026-05-14T01:35:51.157627Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-08T04:37:28.833682Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T04:30:32.472694Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.833682Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:37fb948f39a617da6f17c765416276c50c7d8e025e70e70577602439e669c1a9","observation_id":"75e283ae-38ba-4953-92f4-67cd737699ad","resolution":{"observed_at":"2026-08-08T04:37:28.833682Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":"2407.20859","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":"5d974f12-7aa9-48ab-91d4-b739092384cb","year":2024},"citing_paper":{"arxiv_id":"2503.18666","last_updated":"2025-07-31T04:00:48Z","snapshot_observed_at":"2026-07-06T20:57:47.748881Z","submitted_at":"2025-03-24T13:31:48Z","title":"AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents","version":3},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-05-14T21:24:32.615129Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2503.18666"},"observation_digest":"sha256:43b41f763b4091333a39fc0967193f67c01eaa343ea7b050a132c0f5e6225147","observation_id":"af22e5bb-013d-460b-bc09-2dcc13193c75","resolution":{"observed_at":"2026-05-14T21:24:32.653182Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-07T14:15:48.765487Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.19443","last_updated":"2025-05-26T03:00:21Z","snapshot_observed_at":"2026-08-07T14:11:48.229560Z","submitted_at":"2025-05-26T03:00:21Z","title":"Vibe Coding vs. Agentic Coding: Fundamentals and Practical Implications of Agentic AI","version":1},"reference_index":180,"source":"pdf_text","source_observed_at":"2026-08-07T14:15:48.765487Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2505.19443"},"observation_digest":"sha256:d1b169bdeb7f1c1821b4b84c7936dfdad087b685511e4f7ffea23e367cfca91b","observation_id":"c50de765-5309-4a6b-8205-e12fb77fb6e4","resolution":{"observed_at":"2026-08-07T14:15:48.765487Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-07T14:09:51.938976Z","title":"arXiv preprint arXiv:2407.20859","venue":null,"work_id":null,"year":1995},"citing_paper":{"arxiv_id":"2505.19806","last_updated":"2025-05-26T10:40:52Z","snapshot_observed_at":"2026-08-08T09:25:47.130040Z","submitted_at":"2025-05-26T10:40:52Z","title":"Exploring Consciousness in LLMs: A Systematic Survey of Theories, Implementations, and Frontier Risks","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T14:09:51.938976Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2505.19806"},"observation_digest":"sha256:24f6ea7a7b7bd4bcdbf581479d2b364ededf6543825e079df92827694d056d4f","observation_id":"cc26684a-32d6-4848-8283-16a8a2deb2ae","resolution":{"observed_at":"2026-08-07T14:09:51.938976Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-07T13:00:09.290039Z","title":"Breaking agents: Compromising autonomous LLM agents through malfunction amplification","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.22967","last_updated":"2025-05-29T01:08:36Z","snapshot_observed_at":"2026-08-07T12:54:00.276997Z","submitted_at":"2025-05-29T01:08:36Z","title":"MermaidFlow: Redefining Agentic Workflow Generation via Safety-Constrained Evolutionary Programming","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-07T13:00:09.290039Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2505.22967"},"observation_digest":"sha256:1d65ed90f02e6a7021f2106b26b9edaa35433d82bc50bfe13bad6c8d6493130d","observation_id":"739051ed-4776-46f1-ae67-d86a2954aa29","resolution":{"observed_at":"2026-08-07T13:00:09.290039Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-07T12:14:28.219807Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunc- tion Amplification.CoRR abs/2407.20859, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.00197","last_updated":"2025-05-30T20:08:08Z","snapshot_observed_at":"2026-08-07T12:08:11.088048Z","submitted_at":"2025-05-30T20:08:08Z","title":"When GPT Spills the Tea: Comprehensive Assessment of Knowledge File Leakage in GPTs","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-07T12:14:28.219807Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2506.00197"},"observation_digest":"sha256:2aa0ee3e61c48d47f060d736baf313308c82d24d4d73b843ed857f91dc5ca87c","observation_id":"e2be02a1-f2f4-4f0b-9fdf-db486a9d0823","resolution":{"observed_at":"2026-08-07T12:14:28.219807Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":"2407.20859","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":"5d974f12-7aa9-48ab-91d4-b739092384cb","year":2024},"citing_paper":{"arxiv_id":"2506.02546","last_updated":"2026-04-14T05:32:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-06-03T07:32:57Z","title":"To trust or not to trust: Attention-based Trust Management for LLM Multi-Agent Systems","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-19T11:30:47.877793Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2506.02546"},"observation_digest":"sha256:8e19a3413c6a07d82ce201299afa3062d54ef144f236464e35a734dc2c1c6479","observation_id":"4bc17a46-d09e-42ef-a4c5-2982947c98c6","resolution":{"observed_at":"2026-05-19T11:32:17.403211Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-07T11:00:30.044332Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.03755","last_updated":"2025-06-04T09:22:37Z","snapshot_observed_at":"2026-08-08T01:34:30.382923Z","submitted_at":"2025-06-04T09:22:37Z","title":"Misalignment or misuse? The AGI alignment tradeoff","version":1},"reference_index":104,"source":"pdf_text","source_observed_at":"2026-08-07T11:00:30.044332Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2506.03755"},"observation_digest":"sha256:4f91c7c88a19ad9c20b84129b73a052cf0104d271354e9a8e541229a61096639","observation_id":"5d661501-7bea-4e38-8ac4-eefd7427adba","resolution":{"observed_at":"2026-08-07T11:00:30.044332Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-07T10:54:58.042421Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.04018","last_updated":"2026-06-22T12:47:48Z","snapshot_observed_at":"2026-08-07T10:46:59.056034Z","submitted_at":"2025-06-04T14:46:47Z","title":"AgentMisalignment: Measuring the Propensity for Misaligned Behaviour in LLM-Based Agents","version":3},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-08-07T10:54:58.042421Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2506.04018"},"observation_digest":"sha256:7ab3fa84b64aea4a1a75d9bf1f5d06c0a9f9d6006c15a256fd3eb5e154985d0b","observation_id":"4063b574-a780-46db-9b09-9c93bf741cc7","resolution":{"observed_at":"2026-08-07T10:54:58.042421Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-07T10:35:52.641114Z","title":"LLM-based agents","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.04836","last_updated":"2025-06-05T09:57:15Z","snapshot_observed_at":"2026-08-08T06:09:59.100643Z","submitted_at":"2025-06-05T09:57:15Z","title":"Oversight Structures for Agentic AI in Public-Sector Organizations","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-07T10:35:52.641114Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2506.04836"},"observation_digest":"sha256:772aea6a51445deccb28572de367a13f224398e1a72d9e19bebdcc53886bd042","observation_id":"618e3f50-7bab-4b7b-b2ce-45a9ff0281b3","resolution":{"observed_at":"2026-08-07T10:35:52.641114Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-07T00:32:36.737890Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification.arXiv preprint arXiv:2407.20859, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.13666","last_updated":"2025-06-16T16:24:31Z","snapshot_observed_at":"2026-08-07T00:25:36.770856Z","submitted_at":"2025-06-16T16:24:31Z","title":"We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems","version":1},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-08-07T00:32:36.737890Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2506.13666"},"observation_digest":"sha256:8dc7d975cdca75435c824b78c3a3287aa6a9802b35f531eaccb17a0deb8ce2f6","observation_id":"f589ac32-fc8d-4d1b-96e3-5b2e30bd4aa3","resolution":{"observed_at":"2026-08-07T00:32:36.737890Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-06T21:34:40.846006Z","title":"Breaking agents: Compromising autonomous LLM agents through malfunction amplification,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.23844","last_updated":"2025-06-30T13:34:34Z","snapshot_observed_at":"2026-08-07T18:36:52.892587Z","submitted_at":"2025-06-30T13:34:34Z","title":"A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-06T21:34:40.846006Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2506.23844"},"observation_digest":"sha256:6aa8ffcf0d1df2eac5589380a14ecccf9608f243571aa2d56ffed407b38048d6","observation_id":"38da46af-33d6-4c90-9f1c-191963725db3","resolution":{"observed_at":"2026-08-06T21:34:40.846006Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-05T20:31:46.996573Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-08T02:31:17.622343Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":156,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:46.996573Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:d006276761ffafe2cecb46c2769d59be896abd772e7624a7efe274313282d132","observation_id":"86350cec-1f15-431b-8e67-fda1be52837f","resolution":{"observed_at":"2026-08-05T20:31:46.996573Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-04T17:15:01.750168Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification.arXiv preprint arXiv:2407.20859, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.11035","last_updated":"2025-09-14T01:55:01Z","snapshot_observed_at":"2026-08-04T17:14:58.509975Z","submitted_at":"2025-09-14T01:55:01Z","title":"Free-MAD: Consensus-Free Multi-Agent Debate","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-04T17:15:01.750168Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2509.11035"},"observation_digest":"sha256:d67b7e237a25a9873bf8b18634c57391dc15cbc103aa3d8128557d7aa8141fd9","observation_id":"a8258143-3763-4f6f-a648-1c37df5f0ba3","resolution":{"observed_at":"2026-08-04T17:15:01.750168Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-04T14:42:51.152563Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2509.23573","last_updated":"2026-05-28T01:14:19Z","snapshot_observed_at":"2026-08-04T22:20:08.925642Z","submitted_at":"2025-09-28T02:08:27Z","title":"Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence","version":5},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-04T14:42:51.152563Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2509.23573"},"observation_digest":"sha256:24213b033d6380cbfc8e631a0e9356b89affd6c5f0cbb95ae196dcca1c3f8bb1","observation_id":"6235fe9d-4c70-442a-a49b-4f8aac21bf5c","resolution":{"observed_at":"2026-08-04T14:42:51.152563Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":"2407.20859","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":"5d974f12-7aa9-48ab-91d4-b739092384cb","year":2024},"citing_paper":{"arxiv_id":"2510.23883","last_updated":"2026-04-03T16:27:34Z","snapshot_observed_at":"2026-08-02T13:42:34.526072Z","submitted_at":"2025-10-27T21:48:11Z","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","version":3},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-05-18T03:42:10.703369Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2510.23883"},"observation_digest":"sha256:4a9790ef6d32b88137e8720424fe2004c1673b16c243b351b743c5b8ee9103bd","observation_id":"5398029e-fde9-42d1-bbc1-d7858ae7264f","resolution":{"observed_at":"2026-05-18T03:42:22.436204Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":"2407.20859","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":"5d974f12-7aa9-48ab-91d4-b739092384cb","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:413186e96d12c3744a894f44f98524e2b72c6518cf251e261356ae317442f036","observation_id":"00c339ae-648a-41f4-b060-8eb944fbb130","resolution":{"observed_at":"2026-05-10T00:29:47.748410Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":"2407.20859","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":"5d974f12-7aa9-48ab-91d4-b739092384cb","year":2024},"citing_paper":{"arxiv_id":"2604.23338","last_updated":"2026-05-06T17:17:02Z","snapshot_observed_at":"2026-08-06T19:46:39.219000Z","submitted_at":"2026-04-25T14:57:15Z","title":"A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework","version":2},"reference_index":112,"source":"pdf_text","source_observed_at":"2026-05-08T07:53:13.746141Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2604.23338"},"observation_digest":"sha256:0e1d0ce3843e6fc21ac13a752bc6342f4d768a922cd4a8352d315799c44bf9ed","observation_id":"042a5f95-437d-4c84-a286-a8309732ced0","resolution":{"observed_at":"2026-05-11T20:51:09.070148Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":"2407.20859","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":"5d974f12-7aa9-48ab-91d4-b739092384cb","year":2024},"citing_paper":{"arxiv_id":"2605.03242","last_updated":"2026-05-05T00:21:00Z","snapshot_observed_at":"2026-08-05T09:06:36.339904Z","submitted_at":"2026-05-05T00:21:00Z","title":"Enhancing Agent Safety Judgment: Controlled Benchmark Rewriting and Analogical Reasoning for Deceptive Out-of-Distribution Scenarios","version":1},"reference_index":54,"source":"arxiv_source","source_observed_at":"2026-05-07T16:57:28.155229Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2605.03242"},"observation_digest":"sha256:fe2a6ce4a8608cdde1c28cad11150a7eda4ad1fedba867d92fe1e9ff317ec4f4","observation_id":"0c171232-24de-4559-b3d3-322879d57af4","resolution":{"observed_at":"2026-05-11T23:31:13.133715Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-01T06:04:46.616748Z","title":"arXiv preprint arXiv:2407.20859 , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.22024","last_updated":"2026-07-24T06:43:09Z","snapshot_observed_at":"2026-08-06T15:37:49.497100Z","submitted_at":"2026-07-24T06:43:09Z","title":"Agent Security Needs Redefinition through a Holistic Framework","version":1},"reference_index":271,"source":"arxiv_source","source_observed_at":"2026-08-01T06:04:46.616748Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2607.22024"},"observation_digest":"sha256:bdb5c13fc2b729b3f08273dff8ddb4d4488cb0da7affaa539cc319575ec89247","observation_id":"5c8ccc6b-5e33-40ad-82af-f054abba4f2d","resolution":{"observed_at":"2026-08-01T06:04:46.616748Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2407.20859/citation-record","integrity":"/paper/2407.20859/integrity","json":"/paper/2407.20859/citation-record.json","paper":"/paper/2407.20859"},"outbound":[],"paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification"},"reference_resolution":{"displayed":0,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":0},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"thesis":"As of 8 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 22 inbound Pith citation observations for arXiv:2407.20859."}