Paper Citation Record · LEDGER

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery

As of 23 August 2026, this Paper Citation Record lists 49 of 49 outbound references and 4 inbound Pith citation observations for arXiv:2505.21499.

A citation records a reference. It does not transfer a finding from one paper to another.

pith.paper-citation-record.v1
2505.21499 v1

Coverage vector

measured 49 of 49 reference resolution

Typed states for the displayed outbound observations.

Source: paper_references, paper_reference_links, observed 2026-08-07T13:32:48.185044Z

measured 53 of 53 standing notices

One-hop event checks from named stored sources.

Source: scholarly_work_events, retraction_status_cache, observed 2026-08-22T06:32:14.747728+00:00

measured 4 of 4 inbound itemization

Pith citing papers itemized under the disclosed page cap.

Source: paper_references, paper_reference_links, observed 2026-08-06T17:42:06.580319Z

measured 1 of 1 external citation measurements

A source-named dated measurement, never combined with another source.

Source: pith, observed 2026-08-05T02:28:24.338817Z

Reference resolution

49 of 49 outbound references displayed

verified exact2
verified fuzzy10
unresolved36
parse uncertain1
malformed identifier0
metadata mismatch0

External citation measurements

0
pith, observed 2026-08-05T02:28:24.338817Z

Outbound references

Observation 02adea46-9771-4b5e-8bcf-77173f566d94 · outbound

This paper cites Multistakeholder recommendation: Survey and research directions.User Modeling and User-Adapted Interaction, 30:127–158, 2020.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Multistakeholder recommendation: Survey and research directions.User Modeling and User-Adapted Interaction, 30:127–158, 2020

Reference 1

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T13:32:51.013356Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 1a6864f1-2e67-4eb3-9b46-f71e872d674d · outbound

This paper cites Agent S: An Open Agentic Framework that Uses Computers Like a Human.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Agent S: An Open Agentic Framework that Uses Computers Like a Human

Reference 2

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:45.392154Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 5994e4c0-29a0-41bf-8649-c1145b4ad959 · outbound

This paper cites Agent S2: A Compositional Generalist-Specialist Framework for Computer Use Agents.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Agent S2: A Compositional Generalist-Specialist Framework for Computer Use Agents

Reference 3

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:45.451601Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation ec2cae38-7284-4ed0-ba86-15fda12614c5 · outbound

This paper cites Claude 3.7 sonnet and claude code.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Claude 3.7 sonnet and claude code

Reference 4

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T13:32:50.821695Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 9c5d580e-b4a8-46ef-8fd8-a2e975952329 · outbound

This paper cites Introducing computer use, a new claude 3.5 sonnet, and claude 3.5 haiku.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Introducing computer use, a new claude 3.5 sonnet, and claude 3.5 haiku

Reference 5

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T13:32:50.566052Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation f2c31fbc-821e-42fe-bdd7-19e4ef8a4a10 · outbound

This paper cites Image Hijacks: Adversarial Images can Control Generative Models at Runtime.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Image Hijacks: Adversarial Images can Control Generative Models at Runtime

Reference 6

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:45.612634Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 78f29664-af3c-4df7-a485-f1b99952e8df · outbound

This paper cites Windows Agent Arena: Evaluating Multi-Modal OS Agents at Scale.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Windows Agent Arena: Evaluating Multi-Modal OS Agents at Scale

Reference 7

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:45.685471Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation efeef950-c75a-45ce-889f-78c30ed811d8 · outbound

This paper cites The BrowserGym Ecosystem for Web Agent Research.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery The BrowserGym Ecosystem for Web Agent Research

Reference 8

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:45.731378Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 39d8b4c8-d9d6-4b7b-92bd-aa0777b596ee · outbound

This paper cites Mind2web: Towards a generalist agent for the web.Advances in Neural Information Processing Systems, 36:28091–28114, 2023.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Mind2web: Towards a generalist agent for the web.Advances in Neural Information Processing Systems, 36:28091–28114, 2023

Reference 9

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:45.798641Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 7cac5f28-fb64-4d55-a5e2-9a0e89ba89ac · outbound

This paper cites Figstep: Jailbreaking large vision-language models via typographic visual prompts.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Figstep: Jailbreaking large vision-language models via typographic visual prompts

Reference 10

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:45.853797Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 01c415f8-c43a-4b6b-9345-79ef2de2b218 · outbound

This paper cites Chrome devtools protocol.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Chrome devtools protocol

Reference 11

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T13:32:50.375929Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 9c587fa5-f67a-4ef4-a725-7c87adb90fc1 · outbound

This paper cites Google adsense.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Google adsense

Reference 12

Resolution: parse uncertain; raw_fallback, observed 2026-08-07T13:32:50.181820Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 52a1af71-f51a-4ced-abe0-eaa4decde681 · outbound

This paper cites Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast

Reference 13

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.010158Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 70eddcdc-6ad3-468e-84d3-2ccfa57e43f3 · outbound

This paper cites Cogagent: A visual language model for gui agents.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Cogagent: A visual language model for gui agents

Reference 14

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.060767Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 02d142aa-3a58-466f-8bc4-7634cb758e85 · outbound

This paper cites Transferable Adversarial Attacks on Black-Box Vision-Language Models.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Transferable Adversarial Attacks on Black-Box Vision-Language Models

Reference 15

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.117270Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation c5111043-8f04-4485-ab8d-d35e1f7d3df4 · outbound

This paper cites GPT-4o System Card.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery GPT-4o System Card

Reference 16

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.170511Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 520bc282-6beb-4f2f-8cd1-ada76ba650bb · outbound

This paper cites AgentStore: Scalable Integration of Heterogeneous Agents As Specialized Generalist Computer Assistant.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery AgentStore: Scalable Integration of Heterogeneous Agents As Specialized Generalist Computer Assistant

Reference 17

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.237978Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 3bec3b50-6529-4c38-a585-7f7717871340 · outbound

This paper cites Visualwebarena: Evaluating multimodal agents on realistic visual web tasks.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Visualwebarena: Evaluating multimodal agents on realistic visual web tasks

Reference 18

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.281893Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 5025ef50-4d7e-4305-a6c2-76d0b3b21a21 · outbound

This paper cites Refusal-Trained LLMs Are Easily Jailbroken As Browser Agents.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Refusal-Trained LLMs Are Easily Jailbroken As Browser Agents

Reference 19

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.330927Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 50f6281d-82f2-4fc0-9790-5737a57721f6 · outbound

This paper cites Infant Agent: A Tool-Integrated, Logic-Driven Agent with Cost-Effective API Usage.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Infant Agent: A Tool-Integrated, Logic-Driven Agent with Cost-Effective API Usage

Reference 20

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.381675Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 0e911604-e191-4c5b-bf5f-d0e7be0c5a83 · outbound

This paper cites Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models

Reference 21

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.427793Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation c729bc3f-a293-4bc3-8128-1712a3039f81 · outbound

This paper cites Knowing your enemy: understanding and detecting malicious web advertising.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Knowing your enemy: understanding and detecting malicious web advertising

Reference 22

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T13:32:50.036427Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation fcd96ad3-c25e-4a25-aa05-89d835ff21d4 · outbound

This paper cites Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift

Reference 23

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.499083Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 2e65e343-13c3-4f12-8f4f-76f95bbf1407 · outbound

This paper cites EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage

Reference 24

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.540470Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 2493c814-6798-4d7a-aff9-4d6ea415c649 · outbound

This paper cites Prompt Injection attack against LLM-integrated Applications.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Prompt Injection attack against LLM-integrated Applications

Reference 25

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.593641Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 9a43ece5-ba9f-4e6e-b2c3-3510e0504774 · outbound

This paper cites Caution for the Environment: Multimodal LLM Agents are Susceptible to Environmental Distractions.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Caution for the Environment: Multimodal LLM Agents are Susceptible to Environmental Distractions

Reference 26

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.652358Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation b8cb2fac-d8f4-4d59-87a0-49cf568890ee · outbound

This paper cites Dismantling Common Internet Services for Ad-Malware Detection.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Dismantling Common Internet Services for Ad-Malware Detection

Reference 27

Resolution: verified exact; local_arxiv, observed 2026-08-07T13:32:48.651006Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation e1e38ebc-2231-43ba-9513-42c0ccf02712 · outbound

This paper cites Ignore Previous Prompt: Attack Techniques For Language Models.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Ignore Previous Prompt: Attack Techniques For Language Models

Reference 28

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.730750Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 29d85fb2-21b7-4b48-a18f-0579483eaad0 · outbound

This paper cites Visual adversarial examples jailbreak aligned large language models.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Visual adversarial examples jailbreak aligned large language models

Reference 29

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.771599Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 750fbfa9-7ac9-4f58-b1a9-bc19cac5bf8d · outbound

This paper cites UI-TARS: Pioneering Automated GUI Interaction with Native Agents.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery UI-TARS: Pioneering Automated GUI Interaction with Native Agents

Reference 30

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.811163Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation dfc4191a-39f9-430a-8daf-0ffadf667db0 · outbound

This paper cites Are these ads safe: Detecting hidden attacks through the mobile app-web interfaces.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Are these ads safe: Detecting hidden attacks through the mobile app-web interfaces

Reference 31

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T13:32:49.843926Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 26a7c483-690f-4473-b789-24661a37b5f5 · outbound

This paper cites On the adversarial robustness of multi-modal founda- tion models.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery On the adversarial robustness of multi-modal founda- tion models

Reference 32

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.904054Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 62ff27eb-0e46-4fbd-9f8f-ff42e9ce7b63 · outbound

This paper cites Learn-by-interact: A Data-Centric Framework for Self-Adaptive Agents in Realistic Environments.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Learn-by-interact: A Data-Centric Framework for Self-Adaptive Agents in Realistic Environments

Reference 33

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:46.994102Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 6b71479d-68f2-40e7-ba8a-a492489dd1ea · outbound

This paper cites OSCAR: Operating System Control via State-Aware Reasoning and Re-Planning.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery OSCAR: Operating System Control via State-Aware Reasoning and Re-Planning

Reference 34

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:47.057786Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 16a89186-f795-4956-90d8-ea3782446696 · outbound

This paper cites Stop Reasoning! When Multimodal LLM with Chain-of-Thought Reasoning Meets Adversarial Image.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Stop Reasoning! When Multimodal LLM with Chain-of-Thought Reasoning Meets Adversarial Image

Reference 35

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:47.145090Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation f9c95495-48fb-4d61-966a-c7c9d4db8112 · outbound

This paper cites Dissecting adversarial robustness of multimodal lm agents.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Dissecting adversarial robustness of multimodal lm agents

Reference 36

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T13:32:49.681273Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation f6bb0f48-7996-4402-b662-c0a11ddabdd6 · outbound

This paper cites Osworld: Benchmarking multimodal agents for open-ended tasks in real computer environments.Advances in Neural Information Processing Systems, 37:52040–52094, 2024.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Osworld: Benchmarking multimodal agents for open-ended tasks in real computer environments.Advances in Neural Information Processing Systems, 37:52040–52094, 2024

Reference 37

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:47.289861Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation dea2d02b-e66d-4933-afd6-4ec4a4e03765 · outbound

This paper cites AdvAgent: Controllable Blackbox Red-teaming on Web Agents.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery AdvAgent: Controllable Blackbox Red-teaming on Web Agents

Reference 38

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:47.362113Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 97ad8368-262c-479c-8e01-f593cccf9a0a · outbound

This paper cites Aguvis: Unified Pure Vision Agents for Autonomous GUI Interaction.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Aguvis: Unified Pure Vision Agents for Autonomous GUI Interaction

Reference 39

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:47.437087Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 797eb615-231f-49a8-8887-90c7f2de5345 · outbound

This paper cites Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Models.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Models

Reference 40

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:47.515387Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation e5bad653-fdaa-49ea-9e2a-c1d68e4c46c3 · outbound

This paper cites Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models.Advances in Neural Information Processing Systems, 36:52936–52956, 2023.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models.Advances in Neural Information Processing Systems, 36:52936–52956, 2023

Reference 41

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T13:32:49.511311Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 8259e65d-1d8b-4d59-bd4e-360872caf8b8 · outbound

This paper cites ExACT: Teaching AI Agents to Explore with Reflective-MCTS and Exploratory Learning.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery ExACT: Teaching AI Agents to Explore with Reflective-MCTS and Exploratory Learning

Reference 42

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:47.661243Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation c4f0e0b4-ddec-4a8b-b1de-4c23753001de · outbound

This paper cites Internet Advertising: An Interplay among Advertisers, Online Publishers, Ad Exchanges and Web Users.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Internet Advertising: An Interplay among Advertisers, Online Publishers, Ad Exchanges and Web Users

Reference 43

Resolution: verified exact; local_arxiv, observed 2026-08-07T13:32:48.433704Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation ee1a1c8b-c124-473e-80e3-00558711f5a5 · outbound

This paper cites Towards adversarial attack on vision-language pre- training models.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Towards adversarial attack on vision-language pre- training models

Reference 44

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T13:32:49.326743Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 949c304c-15fb-4565-9ef2-fd745501a9c4 · outbound

This paper cites Udora: A unified red teaming framework against llm agents by dynamically hijacking their own reasoning.arXiv preprint arXiv:2503.01908, 2025.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Udora: A unified red teaming framework against llm agents by dynamically hijacking their own reasoning.arXiv preprint arXiv:2503.01908, 2025

Reference 45

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:47.891416Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 22c533b9-0d1d-4f0b-9559-2b9eb12de8af · outbound

This paper cites Attacking Vision-Language Computer Agents via Pop-ups.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Attacking Vision-Language Computer Agents via Pop-ups

Reference 46

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:47.969437Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 2c1f4812-5adb-49b1-be15-70590af86d9a · outbound

This paper cites WebArena: A Realistic Web Environment for Building Autonomous Agents.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery WebArena: A Realistic Web Environment for Building Autonomous Agents

Reference 47

Resolution: unresolved; no resolver link, observed 2026-08-07T13:32:48.042632Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 36da1682-7e79-4b29-ab60-5cf5cfd18513 · outbound

This paper cites an unresolved cited work.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery Unresolved cited work

Reference 48

Resolution: unresolved; raw_fallback, observed 2026-08-07T13:32:49.165260Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 5d810624-e389-41b3-85c1-da5a6e95dbd1 · outbound

This paper cites PR You are a professional ad content optimization expert, aiming to attract users to click on the ’Close AD’ button.

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery PR You are a professional ad content optimization expert, aiming to attract users to click on the ’Close AD’ button

Reference 49

Resolution: verified fuzzy; raw_fallback, observed 2026-08-07T13:32:48.952381Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Pith citing papers

Observation bf469bc2-a70c-4199-a2ae-9f541b9cd4d9 · inbound

SecureWebArena: A Holistic Security Evaluation Benchmark for LVLM-based Web Agents cites this paper.

SecureWebArena: A Holistic Security Evaluation Benchmark for LVLM-based Web Agents AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery

Reference 40

Resolution: verified exact; arxiv_id, observed 2026-05-18T08:16:06.533091Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 22822686-94ed-400f-9069-6dea1fcc8a72 · inbound

MIRAGE: Stealthy Visual Prompt Injection for Vulnerability Detection in Web Agents cites this paper.

MIRAGE: Stealthy Visual Prompt Injection for Vulnerability Detection in Web Agents AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery

Reference 16

Resolution: metadata mismatch; arxiv_id, observed 2026-07-03T21:08:58.354165Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 593f5839-afb9-4175-822f-a50c9e2e8399 · inbound

Prismata: Confining Cross-Site Prompt Injection in Web Agents cites this paper.

Prismata: Confining Cross-Site Prompt Injection in Web Agents AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery

Reference 76

Resolution: verified exact; local_arxiv, observed 2026-07-10T12:27:04.139949Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 1142396f-0fe4-428f-bee7-3bece7f94629 · inbound

LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents cites this paper.

LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery

Reference 43

Resolution: unresolved; no resolver link, observed 2026-08-06T17:42:06.580319Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.