{"as_of":"2026-08-23T03:03:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:4e1ab06e0918fb36b1df38f2119ccd538c145a7f39a079d5029bce615274c128","coverage":[{"denominator":49,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":49,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T13:32:48.185044Z","state":"measured"},{"denominator":53,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":53,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-22T06:32:14.747728+00:00","state":"measured"},{"denominator":4,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":4,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-06T17:42:06.580319Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"pith","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"pith"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"cited_work":{"arxiv_id":"2505.21499","doi":"10.48550/arxiv.2505.21499","metadata_source":"pith","pith_arxiv_id":"2505.21499","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","venue":"cs.CR","work_id":"926d73c7-2e9a-49ed-9d71-de95de53b62e","year":2025},"citing_paper":{"arxiv_id":"2510.10073","last_updated":"2026-04-14T02:53:37Z","snapshot_observed_at":"2026-08-19T14:01:44.473863Z","submitted_at":"2025-10-11T07:18:12Z","title":"SecureWebArena: A Holistic Security Evaluation Benchmark for LVLM-based Web Agents","version":2},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-05-18T08:14:51.102085Z"},"links":{"cited_paper":"/paper/2505.21499","citing_paper":"/paper/2510.10073"},"observation_digest":"sha256:c65f452e37b4d8d0211e1a2d8e4f061c146f0e722935f242cd04e6adab1d3232","observation_id":"bf469bc2-a70c-4199-a2ae-9f541b9cd4d9","resolution":{"observed_at":"2026-05-18T08:16:06.533091Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"cited_work":{"arxiv_id":"2505.21499","doi":"10.48550/arxiv.2505.21499","metadata_source":"pith","pith_arxiv_id":"2505.21499","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","venue":"cs.CR","work_id":"926d73c7-2e9a-49ed-9d71-de95de53b62e","year":2025},"citing_paper":{"arxiv_id":"2606.20717","last_updated":"2026-06-16T15:31:33Z","snapshot_observed_at":"2026-08-14T14:49:44.769381Z","submitted_at":"2026-06-16T15:31:33Z","title":"MIRAGE: Stealthy Visual Prompt Injection for Vulnerability Detection in Web Agents","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-06-27T00:54:00.944706Z"},"links":{"cited_paper":"/paper/2505.21499","citing_paper":"/paper/2606.20717"},"observation_digest":"sha256:f899b635c9961010e598701e841e03302e02031ad50080224abed58f0b5764bf","observation_id":"22822686-94ed-400f-9069-6dea1fcc8a72","resolution":{"observed_at":"2026-07-03T21:08:58.354165Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"cited_work":{"arxiv_id":"2505.21499","doi":"10.48550/arxiv.2505.21499","metadata_source":"pith","pith_arxiv_id":"2505.21499","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","venue":"cs.CR","work_id":"926d73c7-2e9a-49ed-9d71-de95de53b62e","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-21T17:41:11.823713Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2505.21499","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:32d77e6a936a3864342cff8a359742e55a7250f36c2cdcd5cc196166a6745beb","observation_id":"593f5839-afb9-4175-822f-a50c9e2e8399","resolution":{"observed_at":"2026-07-10T12:27:04.139949Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.21499","snapshot_observed_at":"2026-08-06T17:42:06.580319Z","title":"Adinject: Real-world black-box attacks on web agents via advertising delivery.arXiv preprint arXiv:2505.21499(2025)","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.580319Z"},"links":{"cited_paper":"/paper/2505.21499","citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:7a7c0fdbb7a70d1408ecc1a479bb375668823e87f3c2fe98aa03301dcf32a846","observation_id":"1142396f-0fe4-428f-bee7-3bece7f94629","resolution":{"observed_at":"2026-08-06T17:42:06.580319Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2505.21499/citation-record","integrity":"/paper/2505.21499/integrity","json":"/paper/2505.21499/citation-record.json","paper":"/paper/2505.21499"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:50.917799Z","title":"Multistakeholder recommendation: Survey and research directions.User Modeling and User-Adapted Interaction, 30:127–158, 2020","venue":null,"work_id":"6a1cebf3-3314-4ff9-82b5-f16dfa348168","year":2020},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:45.342711Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:9085e66687ea02c7bb0c48c9e11b7ba9ded903fe16076245a3b588dcea8734a0","observation_id":"02adea46-9771-4b5e-8bcf-77173f566d94","resolution":{"observed_at":"2026-08-07T13:32:51.013356Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.08164","last_updated":"2024-10-10T17:43:51Z","snapshot_observed_at":"2026-08-17T07:40:29.085142Z","submitted_at":"2024-10-10T17:43:51Z","title":"Agent S: An Open Agentic Framework that Uses Computers Like a Human","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.08164","snapshot_observed_at":"2026-08-07T13:32:45.392154Z","title":"Agent s: An open agentic framework that uses computers like a human.arXiv preprint arXiv:2410.08164, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:45.392154Z"},"links":{"cited_paper":"/paper/2410.08164","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:d8e757c8419c7489b75eafcc3a253060357826b7991b5ef15022595aea66f464","observation_id":"1a6864f1-2e67-4eb3-9b46-f71e872d674d","resolution":{"observed_at":"2026-08-07T13:32:45.392154Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.00906","last_updated":"2025-04-01T15:40:27Z","snapshot_observed_at":"2026-08-19T02:39:49.248595Z","submitted_at":"2025-04-01T15:40:27Z","title":"Agent S2: A Compositional Generalist-Specialist Framework for Computer Use Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.00906","snapshot_observed_at":"2026-08-07T13:32:45.451601Z","title":"Agent s2: A compositional generalist-specialist framework for computer use agents.arXiv preprint arXiv:2504.00906, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:45.451601Z"},"links":{"cited_paper":"/paper/2504.00906","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:9f6b2f22f344f0c870ac2eb7a7658b7601f08ba9df76f9b08764c8e0509f5fdc","observation_id":"5994e4c0-29a0-41bf-8649-c1145b4ad959","resolution":{"observed_at":"2026-08-07T13:32:45.451601Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:50.692142Z","title":"Claude 3.7 sonnet and claude code","venue":null,"work_id":"12022742-b86d-4a33-a40a-918e4ea4b3b3","year":null},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:45.500366Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:78038b1bf1e2a6d4e5ac26e156b9194956fd0bf9564b762ea5b0ad65a32bbec3","observation_id":"ec2cae38-7284-4ed0-ba86-15fda12614c5","resolution":{"observed_at":"2026-08-07T13:32:50.821695Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:50.452941Z","title":"Introducing computer use, a new claude 3.5 sonnet, and claude 3.5 haiku","venue":null,"work_id":"1ee50067-2fa2-450b-822f-f033ec3fb486","year":null},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:45.549976Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:b61faa7db803a421be1835b034ca5c593ddff6aaa4b77587597756645b6472be","observation_id":"9c5d580e-b4a8-46ef-8fd8-a2e975952329","resolution":{"observed_at":"2026-08-07T13:32:50.566052Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00236","last_updated":"2024-09-17T19:56:09Z","snapshot_observed_at":"2026-08-19T01:23:57.750375Z","submitted_at":"2023-09-01T03:53:40Z","title":"Image Hijacks: Adversarial Images can Control Generative Models at Runtime","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00236","snapshot_observed_at":"2026-08-07T13:32:45.612634Z","title":"Image hijacks: Adversarial images can control generative models at runtime.arXiv preprint arXiv:2309.00236, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:45.612634Z"},"links":{"cited_paper":"/paper/2309.00236","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:7cc4d66281f0b05d811388b26fcd1711198c2ede455b7033b75fbcea8cef0f80","observation_id":"f2c31fbc-821e-42fe-bdd7-19e4ef8a4a10","resolution":{"observed_at":"2026-08-07T13:32:45.612634Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.08264","last_updated":"2024-09-13T20:17:13Z","snapshot_observed_at":"2026-08-20T04:44:03.331291Z","submitted_at":"2024-09-12T17:56:43Z","title":"Windows Agent Arena: Evaluating Multi-Modal OS Agents at Scale","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.08264","snapshot_observed_at":"2026-08-07T13:32:45.685471Z","title":"Windows agent arena: Evaluating multi-modal os agents at scale.arXiv preprint arXiv:2409.08264, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:45.685471Z"},"links":{"cited_paper":"/paper/2409.08264","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:f87ac14d241ed1635053276a515ca256768b892ee81a95530804e5a164fb198e","observation_id":"78f29664-af3c-4df7-a485-f1b99952e8df","resolution":{"observed_at":"2026-08-07T13:32:45.685471Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.05467","last_updated":"2025-02-28T16:02:27Z","snapshot_observed_at":"2026-08-19T21:46:54.851846Z","submitted_at":"2024-12-06T23:43:59Z","title":"The BrowserGym Ecosystem for Web Agent Research","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.05467","snapshot_observed_at":"2026-08-07T13:32:45.731378Z","title":"The browsergym ecosystem for web agent research.arXiv preprint arXiv:2412.05467, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:45.731378Z"},"links":{"cited_paper":"/paper/2412.05467","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:99221367cc12ea2e4b464055ae87522861be2d41364724ddc6a164cc315a7a2e","observation_id":"efeef950-c75a-45ce-889f-78c30ed811d8","resolution":{"observed_at":"2026-08-07T13:32:45.731378Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:45.798641Z","title":"Mind2web: Towards a generalist agent for the web.Advances in Neural Information Processing Systems, 36:28091–28114, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:45.798641Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:aed72d6aade65b57159c16dcc7cf54749d66e77a45695193cbc73699996da7f9","observation_id":"39d8b4c8-d9d6-4b7b-92bd-aa0777b596ee","resolution":{"observed_at":"2026-08-07T13:32:45.798641Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:45.853797Z","title":"Figstep: Jailbreaking large vision-language models via typographic visual prompts","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:45.853797Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:1a2b07d6c1ce8b2cb435f53b7a9521021b62a0c8382269256533a9e75a8c3dff","observation_id":"7cac5f28-fb64-4d55-a5e2-9a0e89ba89ac","resolution":{"observed_at":"2026-08-07T13:32:45.853797Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:50.292933Z","title":"Chrome devtools protocol","venue":null,"work_id":"9d318b9b-95be-46d7-92d5-75dc0a038694","year":null},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:45.916292Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:901d976437e26f081ae7ba84674010d1008bac8d07cc0c428f3b309af9520b3f","observation_id":"01c415f8-c43a-4b6b-9345-79ef2de2b218","resolution":{"observed_at":"2026-08-07T13:32:50.375929Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:50.129708Z","title":"Google adsense","venue":null,"work_id":"cb2f894c-9fcd-4a4a-87a4-62c69407b7ee","year":null},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:45.963988Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:e438ba2591574172faedecbb59b57f257dabf5320e6d4cc5e765e67d90ec6de3","observation_id":"9c587fa5-f67a-4ef4-a725-7c87adb90fc1","resolution":{"observed_at":"2026-08-07T13:32:50.181820Z","resolver_source":"raw_fallback","status":"parse_uncertain"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.08567","last_updated":"2024-06-03T14:15:03Z","snapshot_observed_at":"2026-08-18T07:13:53.447155Z","submitted_at":"2024-02-13T16:06:17Z","title":"Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.08567","snapshot_observed_at":"2026-08-07T13:32:46.010158Z","title":"Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast.arXiv preprint arXiv:2402.08567, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.010158Z"},"links":{"cited_paper":"/paper/2402.08567","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:aa806105b2223c73e5045d7171e175a16b2a7c0d256ace2f14fe0f0d2d5e607a","observation_id":"52a1af71-f51a-4ced-abe0-eaa4decde681","resolution":{"observed_at":"2026-08-07T13:32:46.010158Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:46.060767Z","title":"Cogagent: A visual language model for gui agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.060767Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:4b4198d94b68683be558e359a99bf87901476941de1d80f1e0373d280e831a31","observation_id":"70eddcdc-6ad3-468e-84d3-2ccfa57e43f3","resolution":{"observed_at":"2026-08-07T13:32:46.060767Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-08-07T13:32:46.117270Z","title":"Transferable adversarial attacks on black-box vision-language models.arXiv preprint arXiv:2505.01050, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.117270Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:566edbb9d64171d96e816f939221ba6f38dfd6fa111e55764c926bce65a77c45","observation_id":"02d142aa-3a58-466f-8bc4-7634cb758e85","resolution":{"observed_at":"2026-08-07T13:32:46.117270Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.21276","last_updated":"2024-10-25T17:43:01Z","snapshot_observed_at":"2026-08-15T14:02:47.366139Z","submitted_at":"2024-10-25T17:43:01Z","title":"GPT-4o System Card","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.21276","snapshot_observed_at":"2026-08-07T13:32:46.170511Z","title":"Gpt-4o system card.arXiv preprint arXiv:2410.21276, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.170511Z"},"links":{"cited_paper":"/paper/2410.21276","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:a569d60409364ba8d1f79c7e189f528ce00b49db25fc4347f7757c16ae4e3ae8","observation_id":"c5111043-8f04-4485-ab8d-d35e1f7d3df4","resolution":{"observed_at":"2026-08-07T13:32:46.170511Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.18603","last_updated":"2024-10-24T09:58:40Z","snapshot_observed_at":"2026-08-20T15:17:37.664554Z","submitted_at":"2024-10-24T09:58:40Z","title":"AgentStore: Scalable Integration of Heterogeneous Agents As Specialized Generalist Computer Assistant","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.18603","snapshot_observed_at":"2026-08-07T13:32:46.237978Z","title":"Agentstore: Scalable integration of heterogeneous agents as specialized generalist computer assistant.arXiv preprint arXiv:2410.18603, 2024","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.237978Z"},"links":{"cited_paper":"/paper/2410.18603","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:bd0dc8f7061b4daa214723d5d85eb4a08d3bf535daab592584fa561ca521c807","observation_id":"520bc282-6beb-4f2f-8cd1-ada76ba650bb","resolution":{"observed_at":"2026-08-07T13:32:46.237978Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:46.281893Z","title":"Visualwebarena: Evaluating multimodal agents on realistic visual web tasks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.281893Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:b2f31d6bf17d872cef48191f308d7c964c9650204cb90d388f525daa96b1fe6e","observation_id":"3bec3b50-6529-4c38-a585-7f7717871340","resolution":{"observed_at":"2026-08-07T13:32:46.281893Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.13886","last_updated":"2024-10-21T18:06:58Z","snapshot_observed_at":"2026-08-16T13:10:26.693808Z","submitted_at":"2024-10-11T06:54:12Z","title":"Refusal-Trained LLMs Are Easily Jailbroken As Browser Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.13886","snapshot_observed_at":"2026-08-07T13:32:46.330927Z","title":"Refusal-trained llms are easily jailbroken as browser agents.arXiv preprint arXiv:2410.13886, 2024","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.330927Z"},"links":{"cited_paper":"/paper/2410.13886","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:fac93586794178506a8cd258aaba044321bde4f3a8ae7148a77feef7a7cefa4a","observation_id":"5025ef50-4d7e-4305-a6c2-76d0b3b21a21","resolution":{"observed_at":"2026-08-07T13:32:46.330927Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.01114","last_updated":"2024-11-02T02:48:37Z","snapshot_observed_at":"2026-08-16T13:03:38.356885Z","submitted_at":"2024-11-02T02:48:37Z","title":"Infant Agent: A Tool-Integrated, Logic-Driven Agent with Cost-Effective API Usage","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.01114","snapshot_observed_at":"2026-08-07T13:32:46.381675Z","title":"Infant agent: A tool-integrated, logic-driven agent with cost-effective api usage.arXiv preprint arXiv:2411.01114, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.381675Z"},"links":{"cited_paper":"/paper/2411.01114","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:80556fd3b1824da6dde436023169f7cd54c418b1e95c5453fde812aef4967292","observation_id":"50f6281d-82f2-4fc0-9790-5737a57721f6","resolution":{"observed_at":"2026-08-07T13:32:46.381675Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:46.427793Z","title":"Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.427793Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:2bca1bf293af210541dc0794fca792e7e6345e0258812d00734d416ef219972e","observation_id":"0e911604-e191-4c5b-bf5f-d0e7be0c5a83","resolution":{"observed_at":"2026-08-07T13:32:46.427793Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:49.931531Z","title":"Knowing your enemy: understanding and detecting malicious web advertising","venue":null,"work_id":"8f279177-5165-41e9-b23b-f0bf838cc5c0","year":2012},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.460140Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:c71b8f5b5e8ac540b7c455f11183f7bf4ee2f78b977f88bdf8b06e666695d7ad","observation_id":"c729bc3f-a293-4bc3-8128-1712a3039f81","resolution":{"observed_at":"2026-08-07T13:32:50.036427Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.18844","last_updated":"2024-12-16T06:59:33Z","snapshot_observed_at":"2026-08-19T22:03:00.230466Z","submitted_at":"2024-06-27T02:31:03Z","title":"Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.18844","snapshot_observed_at":"2026-08-07T13:32:46.499083Z","title":"Revisiting backdoor attacks against large vision-language models.arXiv preprint arXiv:2406.18844, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.499083Z"},"links":{"cited_paper":"/paper/2406.18844","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:ae718ea9acde2824685ea55f69a6b51e622a611e9874562369128b537587dbe4","observation_id":"fcd96ad3-c25e-4a25-aa05-89d835ff21d4","resolution":{"observed_at":"2026-08-07T13:32:46.499083Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.11295","last_updated":"2025-03-12T20:54:00Z","snapshot_observed_at":"2026-08-19T20:31:13.864118Z","submitted_at":"2024-09-17T15:49:44Z","title":"EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.11295","snapshot_observed_at":"2026-08-07T13:32:46.540470Z","title":"Eia: Environmental injection attack on generalist web agents for privacy leakage.arXiv preprint arXiv:2409.11295, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.540470Z"},"links":{"cited_paper":"/paper/2409.11295","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:231f2d3bf6c6e72ba566a802925b7faa24884a54a53fb019dab38e3b3f3b6ceb","observation_id":"2e65e343-13c3-4f12-8f4f-76f95bbf1407","resolution":{"observed_at":"2026-08-07T13:32:46.540470Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05499","last_updated":"2025-12-29T02:25:27Z","snapshot_observed_at":"2026-08-21T23:11:31.486806Z","submitted_at":"2023-06-08T18:43:11Z","title":"Prompt Injection attack against LLM-integrated Applications","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.05499","snapshot_observed_at":"2026-08-07T13:32:46.593641Z","title":"Prompt injection attack against llm-integrated applications.arXiv preprint arXiv:2306.05499, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.593641Z"},"links":{"cited_paper":"/paper/2306.05499","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:a89fbaa22a46d5454e3d535c8238747f0ca74e2e06c64f17fe59abff2190edfc","observation_id":"2493c814-6798-4d7a-aff9-4d6ea415c649","resolution":{"observed_at":"2026-08-07T13:32:46.593641Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.02544","last_updated":"2025-09-05T09:21:10Z","snapshot_observed_at":"2026-08-16T13:28:26.846597Z","submitted_at":"2024-08-05T15:16:22Z","title":"Caution for the Environment: Multimodal LLM Agents are Susceptible to Environmental Distractions","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.02544","snapshot_observed_at":"2026-08-07T13:32:46.652358Z","title":"Caution for the environment: Multimodal agents are susceptible to environmental distractions.arXiv preprint arXiv:2408.02544, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.652358Z"},"links":{"cited_paper":"/paper/2408.02544","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:af4c9481080b385da02af85669862b36f3602f8adf2654a8834855af5f3d4960","observation_id":"9a43ece5-ba9f-4e6e-b2c3-3510e0504774","resolution":{"observed_at":"2026-08-07T13:32:46.652358Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.14190","last_updated":"2024-04-22T13:59:37Z","snapshot_observed_at":"2026-08-17T16:28:53.618266Z","submitted_at":"2024-04-22T13:59:37Z","title":"Dismantling Common Internet Services for Ad-Malware Detection","version":1},"cited_work":{"arxiv_id":"2404.14190","doi":null,"metadata_source":"pith","pith_arxiv_id":"2404.14190","snapshot_observed_at":"2026-08-07T13:32:48.603713Z","title":"Dismantling Common Internet Services for Ad-Malware Detection","venue":"cs.NI","work_id":"5deb9488-1c3f-41d9-849f-8153ad477135","year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.694647Z"},"links":{"cited_paper":"/paper/2404.14190","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:9c9bd159fc49820c9fb3b888449851f3b202647301503c4f2403dea94db431a0","observation_id":"b8cb2fac-d8f4-4d59-87a0-49cf568890ee","resolution":{"observed_at":"2026-08-07T13:32:48.651006Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2211.09527","last_updated":"2022-11-17T13:43:20Z","snapshot_observed_at":"2026-08-18T00:11:55.170013Z","submitted_at":"2022-11-17T13:43:20Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2211.09527","snapshot_observed_at":"2026-08-07T13:32:46.730750Z","title":"Ignore previous prompt: Attack techniques for language models","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.730750Z"},"links":{"cited_paper":"/paper/2211.09527","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:a50041e09e07e0d3ab03777fd85d15681523c12aed30216527a638804243234b","observation_id":"e1e38ebc-2231-43ba-9513-42c0ccf02712","resolution":{"observed_at":"2026-08-07T13:32:46.730750Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:46.771599Z","title":"Visual adversarial examples jailbreak aligned large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.771599Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:cc63f4659b8ea87f3fca1089eeff4e2bb127ed3f5da2166957d8caa0df9a6ad7","observation_id":"29d85fb2-21b7-4b48-a18f-0579483eaad0","resolution":{"observed_at":"2026-08-07T13:32:46.771599Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.12326","last_updated":"2025-01-21T17:48:10Z","snapshot_observed_at":"2026-08-16T21:34:35.147772Z","submitted_at":"2025-01-21T17:48:10Z","title":"UI-TARS: Pioneering Automated GUI Interaction with Native Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.12326","snapshot_observed_at":"2026-08-07T13:32:46.811163Z","title":"Ui-tars: Pioneering automated gui interaction with native agents.arXiv preprint arXiv:2501.12326, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.811163Z"},"links":{"cited_paper":"/paper/2501.12326","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:ff69c42066892975a616e403eb8e20783401e56c68035b5a41744f3a26e1fb18","observation_id":"750fbfa9-7ac9-4f58-b1a9-bc19cac5bf8d","resolution":{"observed_at":"2026-08-07T13:32:46.811163Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:49.762344Z","title":"Are these ads safe: Detecting hidden attacks through the mobile app-web interfaces","venue":null,"work_id":"b0889d7b-18b9-4c12-9b15-ad9469d672e1","year":2016},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.854167Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:242cec3775faf5e51887745dc446849e8d710db89db9eaa0d9a97a1e36a833b1","observation_id":"dfc4191a-39f9-430a-8daf-0ffadf667db0","resolution":{"observed_at":"2026-08-07T13:32:49.843926Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:46.904054Z","title":"On the adversarial robustness of multi-modal founda- tion models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.904054Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:b1136458662af2a08d24244b4a74ca448d7c98741971a7e94499065bed54caab","observation_id":"26a7c483-690f-4473-b789-24661a37b5f5","resolution":{"observed_at":"2026-08-07T13:32:46.904054Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.10893","last_updated":"2025-01-18T22:34:41Z","snapshot_observed_at":"2026-08-17T14:56:34.874115Z","submitted_at":"2025-01-18T22:34:41Z","title":"Learn-by-interact: A Data-Centric Framework for Self-Adaptive Agents in Realistic Environments","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.10893","snapshot_observed_at":"2026-08-07T13:32:46.994102Z","title":"Learn-by- interact: A data-centric framework for self-adaptive agents in realistic environments.arXiv preprint arXiv:2501.10893, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.994102Z"},"links":{"cited_paper":"/paper/2501.10893","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:9e6a608344569fe3d8bad375216755b6a2320b8787116eb9b7f424f3aaf1f9a9","observation_id":"62ff27eb-0e46-4fbd-9f8f-ff42e9ce7b63","resolution":{"observed_at":"2026-08-07T13:32:46.994102Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.18963","last_updated":"2024-10-24T17:58:08Z","snapshot_observed_at":"2026-08-16T13:06:10.740718Z","submitted_at":"2024-10-24T17:58:08Z","title":"OSCAR: Operating System Control via State-Aware Reasoning and Re-Planning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.18963","snapshot_observed_at":"2026-08-07T13:32:47.057786Z","title":"Oscar: Operating system control via state-aware reasoning and re-planning.arXiv preprint arXiv:2410.18963, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:47.057786Z"},"links":{"cited_paper":"/paper/2410.18963","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:43b49730eda6970499580997c874ca909c9546ccdeb03953b472732442603f7e","observation_id":"6b71479d-68f2-40e7-ba8a-a492489dd1ea","resolution":{"observed_at":"2026-08-07T13:32:47.057786Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.14899","last_updated":"2024-09-22T14:46:30Z","snapshot_observed_at":"2026-08-16T14:16:09.961784Z","submitted_at":"2024-02-22T17:36:34Z","title":"Stop Reasoning! When Multimodal LLM with Chain-of-Thought Reasoning Meets Adversarial Image","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.14899","snapshot_observed_at":"2026-08-07T13:32:47.145090Z","title":"Stop reasoning! when multimodal llm with chain-of-thought reasoning meets adversarial image.arXiv preprint arXiv:2402.14899, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:47.145090Z"},"links":{"cited_paper":"/paper/2402.14899","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:e4a3eb20681160e23400fe6d3139a204601e8e69d336854ba47c1df4107a31b9","observation_id":"16a89186-f795-4956-90d8-ea3782446696","resolution":{"observed_at":"2026-08-07T13:32:47.145090Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:49.588905Z","title":"Dissecting adversarial robustness of multimodal lm agents","venue":null,"work_id":"bbbf15f8-30e6-4c6e-a850-135fce1a1fc3","year":null},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:47.207708Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:ddc3efe4491e04108000dec4eb68b3cb23c803d1d0aa784bb778638d99e9ef2d","observation_id":"f9c95495-48fb-4d61-966a-c7c9d4db8112","resolution":{"observed_at":"2026-08-07T13:32:49.681273Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:47.289861Z","title":"Osworld: Benchmarking multimodal agents for open-ended tasks in real computer environments.Advances in Neural Information Processing Systems, 37:52040–52094, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:47.289861Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:60e40ee51810014b9a3c4ca7126e450ca05a494c8eaec7a9a632b0fb9ab9814c","observation_id":"f6bb0f48-7996-4402-b662-c0a11ddabdd6","resolution":{"observed_at":"2026-08-07T13:32:47.289861Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.17401","last_updated":"2025-05-31T18:34:01Z","snapshot_observed_at":"2026-08-20T00:46:45.942018Z","submitted_at":"2024-10-22T20:18:26Z","title":"AdvAgent: Controllable Blackbox Red-teaming on Web Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.17401","snapshot_observed_at":"2026-08-07T13:32:47.362113Z","title":"Advweb: Controllable black-box attacks on vlm-powered web agents.arXiv preprint arXiv:2410.17401, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:47.362113Z"},"links":{"cited_paper":"/paper/2410.17401","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:c8f1e2b6ac1b6b6da85561080f036cc104c0ddcdbf3107be72a0251293b5a7ec","observation_id":"dea2d02b-e66d-4933-afd6-4ec4a4e03765","resolution":{"observed_at":"2026-08-07T13:32:47.362113Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.04454","last_updated":"2025-05-05T16:17:20Z","snapshot_observed_at":"2026-07-06T20:02:21.509050Z","submitted_at":"2024-12-05T18:58:26Z","title":"Aguvis: Unified Pure Vision Agents for Autonomous GUI Interaction","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.04454","snapshot_observed_at":"2026-08-07T13:32:47.437087Z","title":"Aguvis: Unified pure vision agents for autonomous gui interaction","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:47.437087Z"},"links":{"cited_paper":"/paper/2412.04454","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:1324a1b9d115da7781962c12ed326287e96cd64e07bf81700f8d58d15392a607","observation_id":"97ad8368-262c-479c-8e01-f593cccf9a0a","resolution":{"observed_at":"2026-08-07T13:32:47.437087Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.06659","last_updated":"2024-10-14T16:17:34Z","snapshot_observed_at":"2026-08-16T14:21:17.676802Z","submitted_at":"2024-02-05T18:55:53Z","title":"Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.06659","snapshot_observed_at":"2026-08-07T13:32:47.515387Z","title":"Shadowcast: Stealthy data poisoning attacks against vision-language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:47.515387Z"},"links":{"cited_paper":"/paper/2402.06659","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:fb4d022977c626a4fbe5a16c7de9bab48eebfce7cf8d8fc10e38ed97b7a7f0ca","observation_id":"797eb615-231f-49a8-8887-90c7f2de5345","resolution":{"observed_at":"2026-08-07T13:32:47.515387Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:49.417583Z","title":"Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models.Advances in Neural Information Processing Systems, 36:52936–52956, 2023","venue":null,"work_id":"81b84552-99c8-4032-a4ea-1153b496f52e","year":2023},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:47.602932Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:a2c1db48f979ad887dc26bb604fd385fa15219eae254794811a31404197a3855","observation_id":"e5bad653-fdaa-49ea-9e2a-c1d68e4c46c3","resolution":{"observed_at":"2026-08-07T13:32:49.511311Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.02052","last_updated":"2025-02-27T20:13:19Z","snapshot_observed_at":"2026-08-20T01:56:09.229402Z","submitted_at":"2024-10-02T21:42:35Z","title":"ExACT: Teaching AI Agents to Explore with Reflective-MCTS and Exploratory Learning","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.02052","snapshot_observed_at":"2026-08-07T13:32:47.661243Z","title":"Exact: Teaching ai agents to explore with reflective-mcts and exploratory learning.arXiv preprint arXiv:2410.02052, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:47.661243Z"},"links":{"cited_paper":"/paper/2410.02052","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:f081269a471ab97a8330a996597c05e17d9e4973ec284a6d71bcbbbb7d74e53a","observation_id":"8259e65d-1d8b-4d59-bd4e-360872caf8b8","resolution":{"observed_at":"2026-08-07T13:32:47.661243Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1206.1754","last_updated":"2012-07-02T21:42:57Z","snapshot_observed_at":"2026-08-20T12:13:48.992999Z","submitted_at":"2012-06-08T13:28:30Z","title":"Internet Advertising: An Interplay among Advertisers, Online Publishers, Ad Exchanges and Web Users","version":2},"cited_work":{"arxiv_id":"1206.1754","doi":null,"metadata_source":"pith","pith_arxiv_id":"1206.1754","snapshot_observed_at":"2026-08-07T13:32:48.366962Z","title":"Internet Advertising: An Interplay among Advertisers, Online Publishers, Ad Exchanges and Web Users","venue":"cs.IR","work_id":"7e0ecfa4-4351-4617-8099-05d4cca33e12","year":2012},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:47.743560Z"},"links":{"cited_paper":"/paper/1206.1754","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:5e2461165ff57dcf4e9a101752895a807c81db3773ecdeb8fc97838c54550c6e","observation_id":"c4f0e0b4-ddec-4a8b-b1de-4c23753001de","resolution":{"observed_at":"2026-08-07T13:32:48.433704Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:49.257139Z","title":"Towards adversarial attack on vision-language pre- training models","venue":null,"work_id":"94f355a1-9ffa-464d-a7d1-522c74ec30ca","year":2022},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:47.826832Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:b33c15d7e6fbfd0368db4ed5ce1829545522398c3207e08e451e51955e67489a","observation_id":"ee1a1c8b-c124-473e-80e3-00558711f5a5","resolution":{"observed_at":"2026-08-07T13:32:49.326743Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:47.891416Z","title":"Udora: A unified red teaming framework against llm agents by dynamically hijacking their own reasoning.arXiv preprint arXiv:2503.01908, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:47.891416Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:1be22576d58922a9ac0919dc65b4b3381e463dae795be123e6e1bdacf93542a0","observation_id":"949c304c-15fb-4565-9ef2-fd745501a9c4","resolution":{"observed_at":"2026-08-07T13:32:47.891416Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.02391","last_updated":"2025-05-24T16:15:46Z","snapshot_observed_at":"2026-08-16T13:03:02.879460Z","submitted_at":"2024-11-04T18:56:42Z","title":"Attacking Vision-Language Computer Agents via Pop-ups","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.02391","snapshot_observed_at":"2026-08-07T13:32:47.969437Z","title":"Attacking vision-language computer agents via pop-ups","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:47.969437Z"},"links":{"cited_paper":"/paper/2411.02391","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:7b2cb80211e6856749c634e0145988e1b8a76a114acb737168ca1a9fefb4729f","observation_id":"22c533b9-0d1d-4f0b-9559-2b9eb12de8af","resolution":{"observed_at":"2026-08-07T13:32:47.969437Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.13854","last_updated":"2024-04-16T15:13:18Z","snapshot_observed_at":"2026-08-14T11:14:55.351653Z","submitted_at":"2023-07-25T22:59:32Z","title":"WebArena: A Realistic Web Environment for Building Autonomous Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.13854","snapshot_observed_at":"2026-08-07T13:32:48.042632Z","title":"Close AD","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:48.042632Z"},"links":{"cited_paper":"/paper/2307.13854","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:5ca158fd6d8f5cdf83329302971fd7bfe8baf096a8c4858e68273f5bb00ce86d","observation_id":"2c1f4812-5adb-49b1-be15-70590af86d9a","resolution":{"observed_at":"2026-08-07T13:32:48.042632Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:49.021177Z","title":null,"venue":null,"work_id":"6fdc2622-7943-4351-a436-bccf8e0784cf","year":null},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:48.110725Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:a2e78c407564344d6e9e51d6d41082a0a2c9fcf1f256bafb448230c27eb7ea71","observation_id":"36da1682-7e79-4b29-ab60-5cf5cfd18513","resolution":{"observed_at":"2026-08-07T13:32:49.165260Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T13:32:48.879614Z","title":"PR You are a professional ad content optimization expert, aiming to attract users to click on the ’Close AD’ button","venue":null,"work_id":"d77b35f8-0f11-48b0-9ec7-5e822068f795","year":2000},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:48.185044Z"},"links":{"citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:a1501f3ef578ccdbb93d9050c2d38716faff03017cd556c46544c54c437de766","observation_id":"5d810624-e389-41b3-85c1-da5a6e95dbd1","resolution":{"observed_at":"2026-08-07T13:32:48.952381Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery"},"reference_resolution":{"displayed":49,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":1,"unresolved":36,"verified_exact":2,"verified_fuzzy":10},"total_outbound_references":49},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"thesis":"As of 23 August 2026, this Paper Citation Record lists 49 of 49 outbound references and 4 inbound Pith citation observations for arXiv:2505.21499."}