{"as_of":"2026-08-08T05:53:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:eeafeb0b2b8b96f135bf963e2141dec8eef25e907af624de27311da82506b19d","coverage":[{"denominator":0,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":24,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":24,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-07T06:34:17.273281+00:00","state":"measured"},{"denominator":24,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":24,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T14:15:39.937396Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"pith","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"pith"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-07T14:15:39.937396Z","title":"Multi-agent systems execute arbitrary malicious code,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.19443","last_updated":"2025-05-26T03:00:21Z","snapshot_observed_at":"2026-08-07T14:11:48.229560Z","submitted_at":"2025-05-26T03:00:21Z","title":"Vibe Coding vs. Agentic Coding: Fundamentals and Practical Implications of Agentic AI","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-07T14:15:39.937396Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2505.19443"},"observation_digest":"sha256:45f8206f13a673d3609704fc434dc1502fbbf7c2c5347966ba71c1e22f9b72a6","observation_id":"c197dca4-1ded-407b-9300-75cd571f33d5","resolution":{"observed_at":"2026-08-07T14:15:39.937396Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-06T21:34:45.107075Z","title":"Multi-agent systems ex- ecute arbitrary malicious code,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.23844","last_updated":"2025-06-30T13:34:34Z","snapshot_observed_at":"2026-08-07T18:36:52.892587Z","submitted_at":"2025-06-30T13:34:34Z","title":"A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents","version":1},"reference_index":126,"source":"pdf_text","source_observed_at":"2026-08-06T21:34:45.107075Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2506.23844"},"observation_digest":"sha256:cb3df0d5749feadfc08c1205cb4274bf17735a2538d04ccb11253af889daa38d","observation_id":"3620ff31-f342-40df-b6a4-aaba67997c8a","resolution":{"observed_at":"2026-08-06T21:34:45.107075Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-03T18:37:11.072760Z","title":"Bo Wang, Weiyi He, Shenglai Zeng, Zhen Xiang, Yue Xing, Jiliang Tang, and Pengfei He","venue":null,"work_id":null,"year":1998},"citing_paper":{"arxiv_id":"2512.04668","last_updated":"2026-06-03T14:38:00Z","snapshot_observed_at":"2026-08-03T18:37:09.476346Z","submitted_at":"2025-12-04T11:00:49Z","title":"Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs","version":4},"reference_index":2025,"source":"pdf_text","source_observed_at":"2026-08-03T18:37:11.072760Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2512.04668"},"observation_digest":"sha256:25ffa708154b811334a2a56f9094c56fa51a81dc04b40c5497d6eeaf8a6784ae","observation_id":"15eeee1b-2e21-47db-b3d5-28f446e44253","resolution":{"observed_at":"2026-08-03T18:37:11.072760Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2601.03294","last_updated":"2026-04-24T09:00:38Z","snapshot_observed_at":"2026-08-04T12:40:05.079383Z","submitted_at":"2026-01-05T15:42:18Z","title":"AgentMark: Utility-Preserving Behavioral Watermarking for Agents","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-16T17:52:49.826217Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2601.03294"},"observation_digest":"sha256:a939a9a63ab21cd3adbadfcd748698ec96cc53c623388b3d9c63a62555b36ca0","observation_id":"3742b33d-12b7-4195-84da-40221f1006a7","resolution":{"observed_at":"2026-05-16T17:53:11.532827Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2603.04474","last_updated":"2026-05-11T15:41:00Z","snapshot_observed_at":"2026-07-06T22:47:50.848191Z","submitted_at":"2026-03-04T11:45:27Z","title":"From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration","version":2},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-05-15T16:36:43.330447Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2603.04474"},"observation_digest":"sha256:dd594f358fa5a1fba181ed422a27d92b00fd068083363cb7e72da4b799c98ae2","observation_id":"5e16f565-d5b9-456b-895a-d2bd684ae017","resolution":{"observed_at":"2026-05-15T16:40:10.565595Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2603.09002","last_updated":"2026-04-26T14:13:48Z","snapshot_observed_at":"2026-07-06T22:48:26.306802Z","submitted_at":"2026-03-09T22:46:27Z","title":"Security Considerations for Multi-agent Systems","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-15T14:12:14.160789Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2603.09002"},"observation_digest":"sha256:ff055b1e587df1dedd015890a7b10e7e886420dd798a538aab1af9d7d94f001a","observation_id":"0d282159-c660-4f7c-ba60-34383c20e469","resolution":{"observed_at":"2026-05-15T14:15:54.993562Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-07-15T12:11:00.253650Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2603.09133","last_updated":"2026-07-10T10:10:02Z","snapshot_observed_at":"2026-08-06T13:22:32.646364Z","submitted_at":"2026-03-10T03:13:24Z","title":"Detailed analysis of possible new-physics effects in the semileptonic decay $B_s \\to D_s^{(*)}\\tau\\bar{\\nu}$","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-07-15T12:11:00.253650Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2603.09133"},"observation_digest":"sha256:4e5d8249dfa988bbe47906369c27906e232182aed2da63855a90111f8d05c83e","observation_id":"1c562f6c-9c5b-47df-86e4-deec4ffaa155","resolution":{"observed_at":"2026-07-15T12:11:00.253650Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2604.08608","last_updated":"2026-04-20T18:30:51Z","snapshot_observed_at":"2026-07-06T22:57:40.773778Z","submitted_at":"2026-04-08T18:19:03Z","title":"Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-10T17:40:23.128451Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2604.08608"},"observation_digest":"sha256:a093811e2a7e4fb27d99ee843a9f743ec5f1eaf3e009cad50f5e3b6b0c3174e8","observation_id":"24514df3-5749-4d33-b456-1943513c1426","resolution":{"observed_at":"2026-05-11T06:20:58.889968Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2604.14317","last_updated":"2026-04-15T18:20:07Z","snapshot_observed_at":"2026-07-06T23:02:09.426599Z","submitted_at":"2026-04-15T18:20:07Z","title":"Challenges and Future Directions in Agentic Reverse Engineering Systems","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-10T12:49:31.238578Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2604.14317"},"observation_digest":"sha256:0faee317160bf0e3d475bff07084b50afc67f0086be4f604f14c2005067fcfaf","observation_id":"b42ec855-08af-42e0-869a-d5354dc48013","resolution":{"observed_at":"2026-05-10T12:50:24.701927Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2604.16543","last_updated":"2026-04-17T02:31:09Z","snapshot_observed_at":"2026-07-06T23:03:52.631613Z","submitted_at":"2026-04-17T02:31:09Z","title":"Conjunctive Prompt Attacks in Multi-Agent LLM Systems","version":1},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-05-10T08:13:42.401992Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2604.16543"},"observation_digest":"sha256:0cb17590cdcda4f189ea5e7fe42b94028a9e4a73d97baa9cef9a58553c8336c9","observation_id":"0fb10241-542c-443f-b80f-116eddf20081","resolution":{"observed_at":"2026-05-10T08:17:37.696855Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2605.03378","last_updated":"2026-07-08T15:04:28Z","snapshot_observed_at":"2026-08-02T02:34:38.609069Z","submitted_at":"2026-05-05T05:37:00Z","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","version":1},"reference_index":143,"source":"arxiv_source","source_observed_at":"2026-05-07T15:59:49.513500Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2605.03378"},"observation_digest":"sha256:56c17013d7bea1e96c4a4c488759fcbdd28e12fd9c2b6efa2a00a30f21483d9c","observation_id":"db670ae1-ae40-4b94-841e-24d0ca0445f0","resolution":{"observed_at":"2026-05-11T23:56:13.834033Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2605.08460","last_updated":"2026-05-08T20:27:23Z","snapshot_observed_at":"2026-07-06T23:20:43.010758Z","submitted_at":"2026-05-08T20:27:23Z","title":"When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-05-12T01:20:55.221345Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2605.08460"},"observation_digest":"sha256:01e313896523814367062b02eef90d6ab99f335b264b1663993ac3ef2db6d687","observation_id":"57b6b7a0-0f37-459a-b02e-371e0f602ca3","resolution":{"observed_at":"2026-05-12T08:01:33.144109Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2605.11036","last_updated":"2026-05-11T02:28:34Z","snapshot_observed_at":"2026-08-07T01:00:05.011499Z","submitted_at":"2026-05-11T02:28:34Z","title":"Sequential Behavioral Watermarking for LLM Agents","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-05-13T01:44:13.564389Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2605.11036"},"observation_digest":"sha256:a2bae2517b28fb17c9f551b687881090abca2b600dc73fb37ef2dc0012d97cb0","observation_id":"acbc91a1-d7bc-4e26-89c6-d5b153928cbb","resolution":{"observed_at":"2026-05-13T01:47:04.099933Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2606.00497","last_updated":"2026-05-30T03:00:28Z","snapshot_observed_at":"2026-07-31T17:49:49.063236Z","submitted_at":"2026-05-30T03:00:28Z","title":"\"I Strongly Suspect This Website Is a Scam\": Benchmarking PII Leakage and Detection without Defense in Autonomous Web Agents","version":1},"reference_index":151,"source":"arxiv_source","source_observed_at":"2026-06-28T18:53:41.420255Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2606.00497"},"observation_digest":"sha256:86c1c12f6389ccc450a85d82068124f3877535aaf1b523568efa0b2bf129a787","observation_id":"6921c6f5-e747-47fa-8a68-3abb9750f62a","resolution":{"observed_at":"2026-06-28T19:42:36.133114Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2606.10749","last_updated":"2026-06-09T12:01:07Z","snapshot_observed_at":"2026-07-31T21:35:18.696472Z","submitted_at":"2026-06-09T12:01:07Z","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","version":1},"reference_index":169,"source":"pdf_text","source_observed_at":"2026-06-27T12:55:22.831264Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2606.10749"},"observation_digest":"sha256:6ae967dbbf0ad2df76d0d92a1e395046a0290144f2b1c93992ccc5d97409b205","observation_id":"4c55f5ff-b7b2-49e0-b5ae-bf31ba288518","resolution":{"observed_at":"2026-06-27T13:20:56.861621Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2606.12797","last_updated":"2026-06-11T01:46:26Z","snapshot_observed_at":"2026-07-06T23:51:40.528967Z","submitted_at":"2026-06-11T01:46:26Z","title":"The Containment Gap: How Deployed Agentic AI Frameworks Fail Public-Facing Safety Requirements","version":1},"reference_index":46,"source":"arxiv_source","source_observed_at":"2026-06-27T07:25:32.556071Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2606.12797"},"observation_digest":"sha256:2d58270fd8691ca0729f6581913a064d336670bfd1a7ed921276cdb051e8f7e0","observation_id":"01c9d6af-ab45-478f-b192-6a0bd6206d97","resolution":{"observed_at":"2026-07-03T13:58:21.480844Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2606.30602","last_updated":"2026-06-29T17:40:45Z","snapshot_observed_at":"2026-08-03T17:51:38.702679Z","submitted_at":"2026-06-29T17:40:45Z","title":"MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-06-30T04:48:51.748711Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2606.30602"},"observation_digest":"sha256:9eebd88879890090053fec1c40e009fef2c47db673531bb6243df225249efdbc","observation_id":"93786acb-87e0-40fb-b858-9a70b705906b","resolution":{"observed_at":"2026-06-30T16:14:53.967870Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2607.07097","last_updated":"2026-07-08T07:31:37Z","snapshot_observed_at":"2026-08-08T04:49:20.707304Z","submitted_at":"2026-07-08T07:31:37Z","title":"Operational Reframing and Approval-Framed Delegation in Multi-Agent LLM Safety","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-07-09T20:14:36.433937Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2607.07097"},"observation_digest":"sha256:9e6523040cbc0138d23a79984375e50d57115e3bd07270d18a5372464d9a0e8f","observation_id":"dedaafb1-0aa6-45b0-97d2-3ca92045901b","resolution":{"observed_at":"2026-07-09T20:16:29.367118Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-01T14:16:00.056317Z","title":"arXiv preprint arXiv:2503.12188 , year =","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.18826","last_updated":"2026-07-21T08:01:51Z","snapshot_observed_at":"2026-08-07T10:01:48.281554Z","submitted_at":"2026-07-21T08:01:51Z","title":"Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents","version":1},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-01T14:16:00.056317Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2607.18826"},"observation_digest":"sha256:91e8c4b3b7bce80747ff2903e4f0823accf2915c43099738ed33606120ba2197","observation_id":"d976e7ac-341b-42cd-8b2c-dcb1a89582dc","resolution":{"observed_at":"2026-08-01T14:16:00.056317Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-01T00:51:17.583274Z","title":"arXiv preprint arXiv:2503.12188 , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.26120","last_updated":"2026-07-28T17:48:54Z","snapshot_observed_at":"2026-08-07T12:54:18.789385Z","submitted_at":"2026-07-28T17:48:54Z","title":"Even More Deception: Objective Misalignment in Mixed-Motive LLM Multi-Agent Systems","version":1},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-01T00:51:17.583274Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2607.26120"},"observation_digest":"sha256:00689b5b2b6f9e6ff0004441a6fdafce4ffab9bbc1e88c93fa4da2c8faeff844","observation_id":"773b3310-e45e-4e2a-bada-1eed7cd2b555","resolution":{"observed_at":"2026-08-01T00:51:17.583274Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-04T01:03:46.926679Z","title":"Multi-agent systems execute arbitrary malicious code,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00202","last_updated":"2026-07-31T18:27:12Z","snapshot_observed_at":"2026-08-07T03:19:41.307598Z","submitted_at":"2026-07-31T18:27:12Z","title":"From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-04T01:03:46.926679Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2608.00202"},"observation_digest":"sha256:f03adca25cee64479fecc3d78a23928ac30dd8d70f867d8054c4c6f5503560f5","observation_id":"541b6dc2-c999-481c-a71c-6655196b1abf","resolution":{"observed_at":"2026-08-04T01:03:46.926679Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T00:25:59.475710Z","title":"Multi-agent systems execute arbitrary malicious code,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-05T00:25:59.475710Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:1ac22539376a524cf5fc8aafcb054b4d8bc307f5a3d8c92a5bf7e88dc71ca363","observation_id":"6ea42930-0465-4304-98ea-353cd51db98b","resolution":{"observed_at":"2026-08-05T00:25:59.475710Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T04:17:02.535609Z","title":"Multi-agent systems execute arbitrary malicious code,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.535609Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:76b95d390a08f6783a67403cdc30692f1ca3dcdda3b95e02535bc86e5dd39825","observation_id":"df05d453-c18f-46f1-af60-291b8c858210","resolution":{"observed_at":"2026-08-05T04:17:02.535609Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T22:07:42.214656Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.03272","last_updated":"2026-08-04T07:49:58Z","snapshot_observed_at":"2026-08-07T23:10:50.083755Z","submitted_at":"2026-08-04T07:49:58Z","title":"Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivity","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-05T22:07:42.214656Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2608.03272"},"observation_digest":"sha256:2a6fd43f7fb8c82446f1b0960024eba9483be643a10e65362a8af85fe93fc2d1","observation_id":"e69bc127-7d6e-4261-86b0-333670b84d27","resolution":{"observed_at":"2026-08-05T22:07:42.214656Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2503.12188/citation-record","integrity":"/paper/2503.12188/integrity","json":"/paper/2503.12188/citation-record.json","paper":"/paper/2503.12188"},"outbound":[],"paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code"},"reference_resolution":{"displayed":0,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":0},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"thesis":"As of 8 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 24 inbound Pith citation observations for arXiv:2503.12188."}