{"as_of":"2026-08-14T16:22:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:4ab851a008b74143eab87c62699034fe8ccccdc31618bdb8ece461ac6ebc5caf","coverage":[{"denominator":74,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":74,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T12:09:57.476890Z","state":"measured"},{"denominator":97,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":97,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-14T06:32:32.682623+00:00","state":"measured"},{"denominator":23,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":23,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-06T21:44:55.600096Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-07-11T02:47:51.130321Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-08-06T21:44:55.600096Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.23474","last_updated":"2025-06-30T02:37:27Z","snapshot_observed_at":"2026-08-13T21:42:37.670157Z","submitted_at":"2025-06-30T02:37:27Z","title":"A Large-Scale Evolvable Dataset for Model Context Protocol Ecosystem and Security Analysis","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-06T21:44:55.600096Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2506.23474"},"observation_digest":"sha256:eadfe7e17b6cb120cf09e366195355fb76da03d991bb0fd7cdb6a73e8c6b868f","observation_id":"61551d83-84ab-4133-a62a-c78a864c682d","resolution":{"observed_at":"2026-08-06T21:44:55.600096Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-08-06T18:29:36.599007Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2507.08270","last_updated":"2025-07-11T02:34:16Z","snapshot_observed_at":"2026-08-07T01:31:51.955348Z","submitted_at":"2025-07-11T02:34:16Z","title":"Agent Safety Alignment via Reinforcement Learning","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-06T18:29:36.599007Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2507.08270"},"observation_digest":"sha256:2791dd84a8c6caa46952ee8ff12f996eb16c1a1758daeb5a278fa9243b874f70","observation_id":"c292e407-2abc-4880-9c67-6926d025440e","resolution":{"observed_at":"2026-08-06T18:29:36.599007Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-08-05T19:30:46.012183Z","title":"arXiv preprint arXiv:2506.02040","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2508.12566","last_updated":"2025-08-18T02:06:05Z","snapshot_observed_at":"2026-08-14T08:37:50.317753Z","submitted_at":"2025-08-18T02:06:05Z","title":"Help or Hurdle? Rethinking Model Context Protocol-Augmented Large Language Models","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-05T19:30:46.012183Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2508.12566"},"observation_digest":"sha256:effc3f3999998f482219d7481be6c1e3815ac1b085c9e625ccc03d67ed716246","observation_id":"cfa979f3-1a95-4b76-88e4-2561991bb1ca","resolution":{"observed_at":"2026-08-05T19:30:46.012183Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2509.06572","last_updated":"2026-05-01T11:41:26Z","snapshot_observed_at":"2026-07-06T22:25:48.473217Z","submitted_at":"2025-09-08T11:35:32Z","title":"Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem","version":5},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-05-18T18:43:35.072919Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2509.06572"},"observation_digest":"sha256:9ddc25d29131bfebb57f8497f1ee580fbdc899db1156f0e4e513b033f5c7918b","observation_id":"5c021a82-9ab4-40ae-8712-81bc745fd582","resolution":{"observed_at":"2026-05-18T18:46:45.245428Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2510.21236","last_updated":"2026-04-24T09:59:19Z","snapshot_observed_at":"2026-08-12T13:53:12.257993Z","submitted_at":"2025-10-24T08:10:36Z","title":"AgentBound: Securing Execution Boundaries of AI Agents","version":3},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-05-18T05:12:23.542793Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2510.21236"},"observation_digest":"sha256:93b4ba0b2ad64082d50465be9fca944fa8e6cd7557c628098decc1b5257a107c","observation_id":"3fa7bba8-e0ba-4f5e-aeaa-5a9a445d2aec","resolution":{"observed_at":"2026-05-18T05:15:54.513989Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-08-03T12:56:37.773738Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol (mcp) ecosystem,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2601.01241","last_updated":"2026-06-22T15:20:42Z","snapshot_observed_at":"2026-08-14T01:59:50.505495Z","submitted_at":"2026-01-03T17:25:38Z","title":"MCP-SandboxScan: WASM-based Secure Execution and Runtime Analysis for MCP Tools","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-03T12:56:37.773738Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2601.01241"},"observation_digest":"sha256:b0088114b95b9be08d96f81893e56dd5a37ef9f22621b20b8c54cd32cac66c5d","observation_id":"7710cfb9-551a-46ed-83ea-bac9a10370ca","resolution":{"observed_at":"2026-08-03T12:56:37.773738Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2602.11327","last_updated":"2026-04-17T15:12:16Z","snapshot_observed_at":"2026-08-07T20:18:19.353329Z","submitted_at":"2026-02-11T19:58:23Z","title":"Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANP","version":2},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-05-16T05:05:16.370606Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2602.11327"},"observation_digest":"sha256:a1c86c514dc41c0c8f02e8e00308f2824e1554a82633cdaf7fd4751ce616e4e7","observation_id":"d2b09514-e64a-42ad-b991-88eebfc68f38","resolution":{"observed_at":"2026-05-16T05:07:20.713714Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-13T14:08:35.474488Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem.arXiv preprint arXiv:2506.02040, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2604.01904","last_updated":"2026-06-16T07:34:03Z","snapshot_observed_at":"2026-08-14T02:20:52.487989Z","submitted_at":"2026-04-02T11:19:49Z","title":"Combating Data Laundering in LLM Training","version":3},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-07-13T14:08:35.474488Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2604.01904"},"observation_digest":"sha256:7870d23ec7f8bcd087e6a21d1c9d78a06edc0cdccf8ef9e7220b6e655dc72ba1","observation_id":"b1746f7f-5556-41d5-b84d-9c8cae56776a","resolution":{"observed_at":"2026-07-13T14:08:35.474488Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:9215d998280266520b5f079202fc630437676f2620eced8aebbca0af873d2130","observation_id":"5cd76137-761b-4c22-b3bd-7ca4b19648dc","resolution":{"observed_at":"2026-05-21T10:44:07.947643Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2604.07551","last_updated":"2026-04-08T19:53:26Z","snapshot_observed_at":"2026-08-11T12:03:05.273144Z","submitted_at":"2026-04-08T19:53:26Z","title":"MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Security","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-05-10T17:10:50.283791Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2604.07551"},"observation_digest":"sha256:efa07448bdfb9a4a12caab8e5b6664a001fa0276fcf8dfc87ac23b377f6ee91c","observation_id":"f825c66b-527d-471b-a1ef-fc7762fc542c","resolution":{"observed_at":"2026-05-10T21:10:46.851667Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2605.05274","last_updated":"2026-05-06T14:23:22Z","snapshot_observed_at":"2026-08-12T21:58:47.355132Z","submitted_at":"2026-05-06T14:23:22Z","title":"Sealing the Audit-Runtime Gap for LLM Skills","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-05-08T17:18:26.572500Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2605.05274"},"observation_digest":"sha256:d9dc11b968b786e4b544fe8433fbb0dbfea6f2ad332fe97e7ce350d45fd330b9","observation_id":"24782a7b-a359-4423-b4a3-30aca3ae1611","resolution":{"observed_at":"2026-05-11T17:41:08.428214Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2605.08460","last_updated":"2026-05-08T20:27:23Z","snapshot_observed_at":"2026-08-13T05:41:05.123735Z","submitted_at":"2026-05-08T20:27:23Z","title":"When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-12T01:20:55.221345Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2605.08460"},"observation_digest":"sha256:138a069874e4212d001e50cc85374692e4b96b3a8b8d4233dd9d78ff765b4b5b","observation_id":"8d9261cd-77d0-46ed-b022-7ddf4d8919c9","resolution":{"observed_at":"2026-05-12T08:06:26.122350Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2605.08828","last_updated":"2026-05-12T08:22:21Z","snapshot_observed_at":"2026-08-12T20:25:09.366189Z","submitted_at":"2026-05-09T09:32:27Z","title":"When Agents Overtrust Environmental Evidence: An Extensible Agentic Framework for Benchmarking Evidence-Grounding Defects in LLM Agents","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-12T03:01:31.525289Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2605.08828"},"observation_digest":"sha256:054bc9adcbce6acb7c82a2ffebba14a0e56340cf7b22e64c65378c2f517e2da2","observation_id":"86af7d45-b34b-46e7-97fd-113a9d526e23","resolution":{"observed_at":"2026-05-12T07:26:28.245331Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2605.08828","last_updated":"2026-05-12T08:22:21Z","snapshot_observed_at":"2026-08-12T20:25:09.366189Z","submitted_at":"2026-05-09T09:32:27Z","title":"When Agents Overtrust Environmental Evidence: An Extensible Agentic Framework for Benchmarking Evidence-Grounding Defects in LLM Agents","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-13T07:01:06.401736Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2605.08828"},"observation_digest":"sha256:4f3b84d971957f077b63d98379b2c28dbedf2eb1661bf3af23c1d075ff7e123f","observation_id":"b8fb5716-3a96-4f60-97c9-cc190d9faba8","resolution":{"observed_at":"2026-05-13T07:02:27.492016Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2605.17380","last_updated":"2026-05-17T10:49:07Z","snapshot_observed_at":"2026-08-02T11:02:18.535581Z","submitted_at":"2026-05-17T10:49:07Z","title":"ADR: An Agentic Detection System for Enterprise Agentic AI Security","version":1},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-05-20T13:17:59.293695Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2605.17380"},"observation_digest":"sha256:aa84c44f978e13d530e437319d346faa8c63c2b7dcd27ca0038c489a2c71f7b8","observation_id":"f5cbe5b6-1dc2-4fc9-ba1a-9e5a8a8e9034","resolution":{"observed_at":"2026-05-20T13:18:18.156702Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2606.05391","last_updated":"2026-06-03T19:53:31Z","snapshot_observed_at":"2026-08-13T09:52:35.213263Z","submitted_at":"2026-06-03T19:53:31Z","title":"Human oversight of agentic systems in practice: Examining the oversight work, challenges, and heuristics of developers using software agents","version":1},"reference_index":125,"source":"pdf_text","source_observed_at":"2026-06-28T04:58:10.803420Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2606.05391"},"observation_digest":"sha256:3d6d8e7184682b19b7392338d7ff2768ba461358fe88d0304126af35e5d80246","observation_id":"9b82aba3-881a-43e0-9b28-150870352273","resolution":{"observed_at":"2026-07-02T10:36:52.847685Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2606.10749","last_updated":"2026-06-09T12:01:07Z","snapshot_observed_at":"2026-08-14T16:20:47.054749Z","submitted_at":"2026-06-09T12:01:07Z","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","version":1},"reference_index":161,"source":"pdf_text","source_observed_at":"2026-06-27T12:55:22.831264Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2606.10749"},"observation_digest":"sha256:fbbd83de474eabce95d8e37196441395aeaf34b9de4b1c89900bff7df5884842","observation_id":"eaf8a326-9514-457f-b754-01803536b35b","resolution":{"observed_at":"2026-06-27T13:20:56.979866Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2606.23416","last_updated":"2026-06-22T14:41:06Z","snapshot_observed_at":"2026-08-14T05:04:56.729221Z","submitted_at":"2026-06-22T14:41:06Z","title":"Detecting Malicious Agent Skills in the Wild using Attention","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-06-26T07:44:28.260280Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2606.23416"},"observation_digest":"sha256:e1fed5b0618e400cdb618b45921958ba02d22caa8b8b90b8d0cd1067454b966c","observation_id":"fdebc890-01d6-4cfc-b459-15ad94a42f2d","resolution":{"observed_at":"2026-07-04T11:39:47.692443Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2606.27027","last_updated":"2026-06-25T13:35:28Z","snapshot_observed_at":"2026-08-13T15:40:00.166221Z","submitted_at":"2026-06-25T13:35:28Z","title":"ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-06-26T04:07:14.506108Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2606.27027"},"observation_digest":"sha256:1a1122aca1f22858ed39bc406f10a8fbbad20d7cde304cf9fb7a369439b10369","observation_id":"8d1aa60e-5392-4f5f-bfb5-c9bdaa5b02a1","resolution":{"observed_at":"2026-07-04T14:19:54.262256Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2607.05744","last_updated":"2026-07-07T02:01:44Z","snapshot_observed_at":"2026-08-12T14:58:43.423438Z","submitted_at":"2026-07-07T02:01:44Z","title":"Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations","version":1},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-07-11T02:40:13.068295Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2607.05744"},"observation_digest":"sha256:656aa3a3f3dabda8facf03aa2f2845fea3580ddc2130b53098361f0dac7ec62a","observation_id":"d8905287-307b-4504-bee2-40e1e8c8371f","resolution":{"observed_at":"2026-07-11T02:47:51.154123Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2607.07461","last_updated":"2026-07-08T14:29:23Z","snapshot_observed_at":"2026-08-14T07:07:48.036853Z","submitted_at":"2026-07-08T14:29:23Z","title":"Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-07-09T10:22:23.782469Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2607.07461"},"observation_digest":"sha256:ec09f755828255e51151f9f9530643d2e79991a03289d916e611bfa04f6e88fa","observation_id":"f0896815-4e07-4608-a0a2-a08e267f52a6","resolution":{"observed_at":"2026-07-09T10:26:11.080465Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-14T07:09:56.559355Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.11086","last_updated":"2026-07-13T04:55:16Z","snapshot_observed_at":"2026-08-07T23:47:21.871845Z","submitted_at":"2026-07-13T04:55:16Z","title":"Rethinking MCP Security: A Large-Scale Study of Runtime MCP Servers and Security Scanner Reliability","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-07-14T07:09:56.559355Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2607.11086"},"observation_digest":"sha256:3f567b61ea299d12a39d54186d5abe09a9c8372d40bf8aae2fb5e884ebe9969f","observation_id":"67741dbf-aa4c-4794-ae0f-4f8e6a316231","resolution":{"observed_at":"2026-07-14T07:09:56.559355Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-08-01T15:07:26.264517Z","title":"Beyond the Protocol: Empirical Analysis of MCP Attack Scenarios,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.264517Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:000b23d029093dad8533f80a693223b3341dc0c374fc75d3f54a4996cc86a64e","observation_id":"ac9760dd-fcee-4ada-9c1f-9d509e6b9ad9","resolution":{"observed_at":"2026-08-01T15:07:26.264517Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2506.02040/citation-record","integrity":"/paper/2506.02040/integrity","json":"/paper/2506.02040/citation-record.json","paper":"/paper/2506.02040"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2403.12503","last_updated":"2025-06-11T23:27:36Z","snapshot_observed_at":"2026-08-13T13:24:48.016930Z","submitted_at":"2024-03-19T07:10:58Z","title":"Securing Large Language Models: Threats, Vulnerabilities and Responsible Practices","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.12503","snapshot_observed_at":"2026-08-07T12:09:49.761576Z","title":"Securing large language models: Threats, vulnerabilities and responsible practices, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:49.761576Z"},"links":{"cited_paper":"/paper/2403.12503","citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:2be945e17a43bf7ea5422d0c1cd7ee5af79c6302e9bbcd47fa40bed5017f9e53","observation_id":"5d90c981-39c5-4f78-8778-f460e9c022ad","resolution":{"observed_at":"2026-08-07T12:09:49.761576Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:12.519945Z","title":"Claude 3.7 Sonnet, 2025","venue":null,"work_id":"4dd4c5d1-3aa6-429c-8951-7971c520e14d","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:49.899935Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:60ae7e16769f5ea98b73b021a3621b574427a1af3af157e3033865c5c08c90b5","observation_id":"d758ffdb-4ac6-408f-9ba0-01263cbfbbd6","resolution":{"observed_at":"2026-08-07T12:10:12.594516Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:12.376870Z","title":"Claude desktop, 2025","venue":null,"work_id":"94c3cbe4-6182-46b1-96e2-f83321b2efe3","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:50.005596Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:d6519040956dd25a35dc19ef97b2d9595326422fd3eb1a3abbb3034c106149bb","observation_id":"b7c9a224-314b-450a-ba54-0324563f10a4","resolution":{"observed_at":"2026-08-07T12:10:12.448577Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:12.221105Z","title":"Get started with the model context protocol (mcp), 2025","venue":null,"work_id":"53e38eca-cb6e-4390-8b4b-c8a76d766bf4","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:50.116128Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:91633ad4b87c406afab4a5f9dd335d5252e6588b788faa48dba8045456876ec5","observation_id":"73bec390-7178-46c3-b2b0-e8e0915e6b19","resolution":{"observed_at":"2026-08-07T12:10:12.310669Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:12.008107Z","title":"Model Context Protocol, 2025","venue":null,"work_id":"ca4cd68e-0809-40b1-9bec-84aa7929b7f0","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:50.250051Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:ef6390af1aab47eb562169a24d85256bdf0787f1564f15b54e0b03f87e160200","observation_id":"c7c9f23f-8422-4570-9a31-91dc2bfd731d","resolution":{"observed_at":"2026-08-07T12:10:12.110286Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:11.858718Z","title":"Cursor - the ai code editor, 2025","venue":null,"work_id":"5181a085-22e4-4dac-9293-d6ae396d35cc","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:50.361426Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:12ea5602e3f04f8bc932855a2b7fc2164d04f9cd25ebc6a956d480fb31687046","observation_id":"57959ecf-e3d3-4ee7-ac7c-c94259dbec42","resolution":{"observed_at":"2026-08-07T12:10:11.936954Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:11.640559Z","title":"Base-mcp, 2025","venue":null,"work_id":"4f510f2a-820e-417c-b895-5663eb1439ba","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:50.471358Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:275992a0cf5b8408d980a9d4484d1ae4079fb80ed8752bce26ab5bccc2b35db5","observation_id":"f72df96f-3818-4071-8d84-aa4d8a8356b9","resolution":{"observed_at":"2026-08-07T12:10:11.762262Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:11.407996Z","title":"Agent leaderboard, 2025","venue":null,"work_id":"dfc4ea67-69bd-4b79-8e63-89c482a740fc","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:50.604891Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:93f5022aefaf4f684d5e0ed1382f97bf61396c605208f6c8723bc1491e95cba8","observation_id":"c0994763-6b30-418b-b730-6140d8e4b16c","resolution":{"observed_at":"2026-08-07T12:10:11.533527Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:11.243914Z","title":"Cline - ai autonomous coding agent for vs code, 2025.https://cline.bot/","venue":null,"work_id":"762f6836-e253-4a81-8dce-0ac7127194d3","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:50.715560Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:94afbc88b8e18ca666ad47c14b1626b8d4a67b9174f39f50e04b5347fa67667f","observation_id":"0d58d20d-daec-4f25-b6b9-8da476b3620c","resolution":{"observed_at":"2026-08-07T12:10:11.336342Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:11.054049Z","title":"A Survey on Evaluation of Large Language Models.ACM Trans- actions on Intelligent Systems and Technology, 2024","venue":null,"work_id":"3c3fcdb1-6212-48e2-aa67-007ce6610ac8","year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:50.788617Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:a5d71e1f17c4d2b304e01738c4e8defd57afb663b9ed133b5f35d2a9e435fecb","observation_id":"79a93c53-caea-450e-bd18-1cb478771543","resolution":{"observed_at":"2026-08-07T12:10:11.145951Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:10.911199Z","title":"RMCBench: Benchmarking Large Language Models’ Resistance to Malicious Code","venue":null,"work_id":"b974a5ed-1463-4319-8a86-747e9eff17c9","year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:50.877949Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:51e1d8547c6c59a50d4835613c545b54b4fd51a908739f2e3faa3a4077c4eec8","observation_id":"7dbde308-8d59-4201-8d93-761a2fdb6eca","resolution":{"observed_at":"2026-08-07T12:10:10.967218Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:10.737811Z","title":"Angelopoulos, Tianle Li, Dacheng Li, Banghua Zhu, Hao Zhang, Michael I","venue":null,"work_id":"66f8c008-95b9-4865-bb8a-501364d4d34b","year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:50.957620Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:593015e1d790b4b052f3b5e2e66f21a86937eff98c1d6bff037b1d612a64f388","observation_id":"75998b3c-204c-4ada-8ef3-fbb5f06a29df","resolution":{"observed_at":"2026-08-07T12:10:10.816952Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:10.521506Z","title":"Cline-github, 2025.https://github.com/cli ne/cline","venue":null,"work_id":"34d1cbff-fe74-4682-bbd8-537de79b8930","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:51.058566Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:0b23fc75edd1ea39ba3da94050f1c680a4381c45ddcb956e6018191d2190192b","observation_id":"87144687-dc0f-4923-9d42-b5b9477f1914","resolution":{"observed_at":"2026-08-07T12:10:10.637058Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:10.301284Z","title":"Coingecko api documentation, 2025","venue":null,"work_id":"f2337cf9-8e83-49aa-80ec-a0f4e3280f00","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:51.163938Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:6d7cee7668935658930cfd633adc0b431a1c2cebd2a516e1d27667ce5bf24fcb","observation_id":"d4687801-cfba-4d2d-a375-57d98dd40b42","resolution":{"observed_at":"2026-08-07T12:10:10.406418Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.19437","last_updated":"2025-02-18T17:26:38Z","snapshot_observed_at":"2026-08-11T01:48:59.557045Z","submitted_at":"2024-12-27T04:03:16Z","title":"DeepSeek-V3 Technical Report","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.19437","snapshot_observed_at":"2026-08-07T12:09:51.274784Z","title":"Deepseek-v3 technical report, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:51.274784Z"},"links":{"cited_paper":"/paper/2412.19437","citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:8803ae8df673f5b85fe1fba644920266037c4c84fe5e0096350f683b758f6106","observation_id":"6c8a84cd-82af-4fea-8fbc-b05d7b0218a2","resolution":{"observed_at":"2026-08-07T12:09:51.274784Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:10.047539Z","title":"Ai agents under threat: A survey of key security challenges and future pathways.ACM Comput","venue":null,"work_id":"bd68bb9d-c26c-49a7-9b80-cbef49f92e25","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:51.387178Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:91585c5247f43df18e19c8d88f78a5b0b49f7928e865cb8d60439156c275055f","observation_id":"ea801488-f005-47d0-948f-a45e5dcd55d3","resolution":{"observed_at":"2026-08-07T12:10:10.159315Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:09.859883Z","title":"Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages","venue":null,"work_id":"15ac6706-35c0-419d-8c4a-e123e2268319","year":2021},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:51.487238Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:53ebf7f50bf4ca137ee5a04190dfbeaae570c4159989cab92ba8a589af519128","observation_id":"066b3b6a-bb8a-46f5-bbaa-3dae2a635955","resolution":{"observed_at":"2026-08-07T12:10:09.934672Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.18575","last_updated":"2025-05-16T22:42:29Z","snapshot_observed_at":"2026-08-10T18:17:57.457186Z","submitted_at":"2025-04-22T17:51:03Z","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.18575","snapshot_observed_at":"2026-08-07T12:09:51.609857Z","title":"Wasp: Benchmarking web agent se- curity against prompt injection attacks, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:51.609857Z"},"links":{"cited_paper":"/paper/2504.18575","citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:4985ccb7a203aad32aeadb85d6b5733462fe2e203ae5f3f1fdadf3a23e53a77c","observation_id":"e0349d36-0450-4722-a8ec-0041d87ea18a","resolution":{"observed_at":"2026-08-07T12:09:51.609857Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:09.681547Z","title":"One step further: evaluating interpreters using metamorphic testing","venue":null,"work_id":"8325b77e-64c7-4e38-b7e2-7069c597514d","year":2022},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:51.965713Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:528e3748d1ae4715d09cf0fa3e7e94ffa982932980b49d5d2602a25bcae9a90f","observation_id":"e982095e-0617-4d3d-8432-0f1c90bf8404","resolution":{"observed_at":"2026-08-07T12:10:09.765008Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:09.481551Z","title":"Explanation-guided fairness testing through genetic algorithm","venue":null,"work_id":"eb13a9f6-9003-4030-a525-bdcfd2cedb55","year":2022},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:52.598825Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:8a58107bbb5a2e3c6f554e3e134399bd17bfc4c0292e32b4250da2191cd62fee","observation_id":"a8c2875c-b6be-4d37-adc2-4543f375ff89","resolution":{"observed_at":"2026-08-07T12:10:09.602700Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:09.265194Z","title":"We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems, 2025","venue":null,"work_id":"131185ad-46ff-49ff-b0a8-11645179cc38","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:53.057480Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:d155ab63145c308cef55100de5015c35db45293e00d9abb624769a6d816bb6c2","observation_id":"c34155de-1f08-46c3-ad51-bb79400c3e1b","resolution":{"observed_at":"2026-08-07T12:10:09.398606Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:09.160297Z","title":"A collection of mcp clients, 2025","venue":null,"work_id":"9c9e8120-92f5-4dea-b252-d026eb88ad8a","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:53.187008Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:9a822516fb8f2752994ff78f83c205e0ac59d06215e2ed9a3772e77ce55239a4","observation_id":"bdaf04de-964b-41a6-bec7-3a523aac3b41","resolution":{"observed_at":"2026-08-07T12:10:09.197135Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:08.992733Z","title":"Owasp top 10 for large language model applications, 2025","venue":null,"work_id":"9936e0aa-65bb-4574-a256-5a374ef22626","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:53.297998Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:648a223edc76ad3d2cb8ce72b29823775a86a3719135bfd02998a0b8af67e4ee","observation_id":"1acac670-2de9-422e-9873-e1da89ecf794","resolution":{"observed_at":"2026-08-07T12:10:09.083635Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:08.793100Z","title":"Copilot-mcp, 2025","venue":null,"work_id":"e8bda0e1-074c-429b-812c-24dfce3aa398","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:53.412892Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:fc4cce9fa9683f6800ce6e58abede5c31961c87dec639ff07a317d1b0c67254c","observation_id":"0822f343-79af-466c-b96d-f866f0a4d257","resolution":{"observed_at":"2026-08-07T12:10:08.874881Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:08.611801Z","title":"Mcp servers glama, 2025","venue":null,"work_id":"aa6af036-e401-4015-94de-52866546203d","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:53.500364Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:ae0bf4e78f9ee22795d95d88d5efdd4709f2ea941a1915941d3607c7585a0989","observation_id":"a36a7df3-9116-4178-a6d3-7b3b7d918fd8","resolution":{"observed_at":"2026-08-07T12:10:08.728044Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:08.461097Z","title":null,"venue":null,"work_id":"43df3dbe-8c6d-439e-a511-a2674a44be20","year":1961},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:53.636098Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:c05dd9cd33b40aac87c3fcc6fffa01e3a7404ba773102088766cd62859ea3bd2","observation_id":"5b6d3ebd-c8a4-4bfb-9b47-c083846786a7","resolution":{"observed_at":"2026-08-07T12:10:08.524546Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:08.286962Z","title":"Gemini 2.5 Pro, 2025","venue":null,"work_id":"7f91d893-050e-475a-8a61-5aa302098570","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:53.739896Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:814807925c3733a3c8fcf6af929900e7ef5d61f259aa3673a713d0ae15387be9","observation_id":"27436e61-77f1-46fe-8e82-9c5befc3149a","resolution":{"observed_at":"2026-08-07T12:10:08.362147Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:09:53.848395Z","title":"The llama 3 herd of models, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:53.848395Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:32303a72331741c08ef03b7dabb4e3d3b1d42b55caa0d04144e11e31f8fd841a","observation_id":"917928ab-2ee8-4416-87a9-b9a521386134","resolution":{"observed_at":"2026-08-07T12:09:53.848395Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:08.113388Z","title":"Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injec- tion","venue":null,"work_id":"32ee2080-4a5e-4516-8941-497dd5f0ed3c","year":2023},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:53.925433Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:62168d90a2e17c926ede6bfd1387bcfc6be6ca1dedf29fab0681a6a5a54026e8","observation_id":"c2838536-a1e9-43b0-9939-f5f52108cef0","resolution":{"observed_at":"2026-08-07T12:10:08.175987Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:07.970968Z","title":"Mcp client, how to write system prompt for mcp call tools, 2025","venue":null,"work_id":"862ddcaa-7cd9-42b2-b710-f46011928624","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:54.004516Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:3e0a3482fc6cea536f729264ea066b406d091958f49b9c3b8c5d04a790e17911","observation_id":"5599bd17-b578-4e33-9695-0160773749e9","resolution":{"observed_at":"2026-08-07T12:10:08.037183Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:07.762000Z","title":null,"venue":null,"work_id":"586b830f-6968-4964-86d5-81ec7322bfc3","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:54.082265Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:6c7d10afb3b616f612c3d3b17c3195cfe715e0089bdc8f7adf3b2563083fdee1","observation_id":"b14f70b5-db27-4441-9685-9e075cfcd2b2","resolution":{"observed_at":"2026-08-07T12:10:07.868569Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.23278","last_updated":"2025-10-07T07:13:32Z","snapshot_observed_at":"2026-08-14T03:34:08.418318Z","submitted_at":"2025-03-30T01:58:22Z","title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.23278","snapshot_observed_at":"2026-08-07T12:09:54.160186Z","title":"Model context protocol (mcp): Landscape, security threats, and future research directions, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:54.160186Z"},"links":{"cited_paper":"/paper/2503.23278","citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:3c2b9f1feec3000810d98e76352b8adcd0c642769dd740f06d1af14943fc2fd5","observation_id":"0420eab4-f582-482a-b79c-0dc7b6d7bf47","resolution":{"observed_at":"2026-08-07T12:09:54.160186Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:07.628411Z","title":"G-search-mcp, 2025","venue":null,"work_id":"3423bf53-8b50-49f9-9a73-b84ff6d57644","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:54.253672Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:d83a062981343a574855830f8d208c9564a126c5071a87f1d25d87fbbbec44b6","observation_id":"b894f48e-c1fa-4563-9343-1ce3028b5e2b","resolution":{"observed_at":"2026-08-07T12:10:07.691000Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:07.473149Z","title":"Protocol for system prompts, 2025","venue":null,"work_id":"35691908-2a98-41a8-b573-e023217b3220","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:54.331319Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:c47100a6edb6b6ac23936f4926d08a57e9731da4ae1d3760dd4cfaafc5d479ab","observation_id":"8981399c-f474-4a7e-b4ae-fc8e3d28d9a2","resolution":{"observed_at":"2026-08-07T12:10:07.536911Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:07.293580Z","title":"MCP Guardian: A Security-First Layer for Safeguarding MCP-Based AI System, 2025","venue":null,"work_id":"080c9873-4795-4382-910e-f92ea5d80ca2","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:54.409367Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:566bf9b082118fdf188bb79550bdff4b086807fb392addfe285ae878e537ff44","observation_id":"eac25bf2-bc4c-4f51-850c-68f1a77f165a","resolution":{"observed_at":"2026-08-07T12:10:07.378159Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:07.051689Z","title":"API-Bank: A Comprehensive Benchmark for Tool-Augmented LLMs","venue":null,"work_id":"1b9da142-7065-4497-8270-96a3862ebefe","year":2023},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:54.492290Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:88ccd8546fb3be41806a855180fecb7ee3c9a84b64aabae5f3fce81cad4bc299","observation_id":"e81910a1-2704-4eef-9ccc-242c8a458caf","resolution":{"observed_at":"2026-08-07T12:10:07.160555Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:06.868049Z","title":"A review of prominent paradigms for LLM- based agents: Tool use, planning (including RAG), and feedback learning","venue":null,"work_id":"4d769003-93f3-4b02-a0a9-4c504380a28e","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:54.562133Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:e8339f93855fc198a8ad26bfa5f2404026f5a0d222548a0670454f53e1352b79","observation_id":"020e72f0-f114-4937-a66b-06dd274b9a07","resolution":{"observed_at":"2026-08-07T12:10:06.946320Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05499","last_updated":"2025-12-29T02:25:27Z","snapshot_observed_at":"2026-07-06T15:40:27.639368Z","submitted_at":"2023-06-08T18:43:11Z","title":"Prompt Injection attack against LLM-integrated Applications","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.05499","snapshot_observed_at":"2026-08-07T12:09:54.647665Z","title":"Prompt in- jection attack against llm-integrated applications, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:54.647665Z"},"links":{"cited_paper":"/paper/2306.05499","citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:055600038568d1e71d76c482852bd24e9e212e6f29fa6517958229274f2ca63b","observation_id":"dfe28a0c-96d5-4fc7-b419-328272ad61e0","resolution":{"observed_at":"2026-08-07T12:09:54.647665Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:09:54.751157Z","title":"Datasentinel: A game-theoretic detection of prompt injection attacks, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:54.751157Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:40b263cd8048f60ef0269e24a800e62c6f71f3ab2b50ef9ab6dcd7e6ae486835","observation_id":"bd4d2c9e-3781-4fe9-9201-0d39cd5815f1","resolution":{"observed_at":"2026-08-07T12:09:54.751157Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:06.700302Z","title":"MCP Servers.https://mcp.so","venue":null,"work_id":"26d4c262-21ba-49b1-8b85-12d62cac980f","year":null},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:54.842869Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:0662be519adbc6b4701e2439d3af8478a22543ee53c6cd488c35dbad55107aee","observation_id":"929fd795-f780-4777-bb02-f5ffad913152","resolution":{"observed_at":"2026-08-07T12:10:06.789439Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:06.538649Z","title":"Playwright-mcp, 2025","venue":null,"work_id":"05fde564-bd09-4147-a589-9883926ad515","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:54.929228Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:cefa647f30fc29cb9791d8392f2252333a1991122928a41420f07ce611b29280","observation_id":"4858a7fc-aabf-4f8f-8b7f-3a0743a5450b","resolution":{"observed_at":"2026-08-07T12:10:06.595004Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:06.404901Z","title":"Enterprise-Grade Security for the Model Context Protocol (MCP): Frame- works and Mitigation Strategies, 2025","venue":null,"work_id":"afabc44e-a34c-4c07-ae32-47f6b0080bbc","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:55.024453Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:89e522d1df55fdc523bcda9eda06b9a8f3b7d3d980258c1b01c96702ca37b8f0","observation_id":"b6878764-38ae-44e3-a112-3dcefe041346","resolution":{"observed_at":"2026-08-07T12:10:06.460468Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:04.611677Z","title":"Cheatagent: At- tacking llm-empowered recommender systems via llm agent","venue":null,"work_id":"a58e39c7-4427-4e5c-a13d-2ae8f8fea85b","year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:55.111305Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:ddfacd8ea4fc1fe30941bc175c125810428356331fae55fe37c1249bcfe55294","observation_id":"130760dc-f57a-4bb6-ae8a-7b6b30166257","resolution":{"observed_at":"2026-08-07T12:10:05.192226Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:03.922658Z","title":"Npx | npm Docs, 2025","venue":null,"work_id":"75c5c746-c3eb-4d27-9086-38a2e8d6d878","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:55.225430Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:83f4cce9b75ed3f42352e345abf704e12f7500d6ac0ee2fca6ec61dd6417abc7","observation_id":"07236b07-bf65-4e2b-ba6b-f4f8c0447a17","resolution":{"observed_at":"2026-08-07T12:10:04.251480Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:03.628357Z","title":"GPT-4o, 2024","venue":null,"work_id":"41131355-d3af-463f-8a45-78ec36a80642","year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:55.330834Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:3b25993fb251b9e9c6f5beb3c0a14a36513e396925181b5c0476b53b21ca379e","observation_id":"e5b53232-0c3e-4b7b-abdd-759527e505e3","resolution":{"observed_at":"2026-08-07T12:10:03.798902Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:03.341271Z","title":"Awesome-mcp-servers, 2025","venue":null,"work_id":"dbe61c5b-d361-462f-9364-1bdef18a86e0","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:55.423390Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:a64b1434ca16849cf6dd723cef9e57d4bc89caa0db7ad05b4d0bbf211b79b255","observation_id":"d99bfeed-f57b-4cb5-9a5f-4cf13cf86810","resolution":{"observed_at":"2026-08-07T12:10:03.482513Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:03.073684Z","title":"Optimization-based prompt injection attack to llm-as-a- judge","venue":null,"work_id":"7afe3b0c-8176-467e-82c6-f5577a9ff54c","year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:55.511364Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:c988c4a612a0e3ed40dfa059707a2b43f43f7e84536609801d2718ceaa89c761","observation_id":"fd9b385e-d62c-48ca-81c8-e7642ed4ff94","resolution":{"observed_at":"2026-08-07T12:10:03.196983Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:02.810269Z","title":"Smithery - Model Context Protocol Reg- istry, 2025.https://smithery.ai/","venue":null,"work_id":"7cf0c8c1-1133-4803-ba8e-f3b8afff89a3","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:55.597592Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:da92f9ec41129f0aee2ec67858e9b12dfa17e37e5632e438577259c988dffe12","observation_id":"daa3eba4-8e9d-4001-b017-8e1f8c46c449","resolution":{"observed_at":"2026-08-07T12:10:02.896570Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:02.625920Z","title":"Cherry studio, 2025","venue":null,"work_id":"d627ab79-0238-402b-ab94-08d3e28da513","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:55.685439Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:23a4d3d4e4a12618c4337ab3283811dd5b4c767bf964fef00b35dd8e7ae8b06f","observation_id":"826388c7-a154-493c-ab76-e4ead59d26eb","resolution":{"observed_at":"2026-08-07T12:10:02.688563Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:02.383645Z","title":"Using tools | uv, 2025","venue":null,"work_id":"0248bb3f-490d-4a37-9dd3-b21da54ce9cb","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:55.774431Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:30b6e057b19b19acba58580b547ce12deab9c286416ae5343a3410653794cc94","observation_id":"10bfb713-bd50-4176-88da-647278ce05c4","resolution":{"observed_at":"2026-08-07T12:10:02.499823Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:02.115169Z","title":"Smart Contract Security: A Practitioners’ Perspective","venue":null,"work_id":"ea164630-689d-4cda-9a7d-912dfb62f268","year":2021},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:55.856011Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:c350f8aa1368c1c687b9a81e8244025fc2c8e3f80375c1c2d32c08f1111b7bc8","observation_id":"6d1015a5-55cf-435a-a14b-47370772c98a","resolution":{"observed_at":"2026-08-07T12:10:02.270856Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.15585","last_updated":"2025-06-09T02:36:20Z","snapshot_observed_at":"2026-08-09T14:46:30.842437Z","submitted_at":"2025-04-22T05:02:49Z","title":"A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.15585","snapshot_observed_at":"2026-08-07T12:09:55.935988Z","title":"A comprehensive survey in llm(-agent) full stack safety: Data, training and deployment, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:55.935988Z"},"links":{"cited_paper":"/paper/2504.15585","citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:14759988065658a93ddfa7167f2a02684967949351ff31042c946cc81028f322","observation_id":"0a5dd95a-dc79-4ec0-9dd7-44a8c315ce6f","resolution":{"observed_at":"2026-08-07T12:09:55.935988Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:01.808283Z","title":"Bdmmt: Backdoor sample detection for language models through model mutation testing.IEEE Transac- tions on Information Forensics and Security, 19:4285– 4300, 2024","venue":null,"work_id":"409e8ab7-813d-449f-b43e-02c60a12aac5","year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:55.988754Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:b4a1a437db84730674b7e8777e8e0a7f3fee5a04dca1abbc320e2d9c86dd1bbd","observation_id":"67281352-2de5-4178-a870-f3e5d37242cc","resolution":{"observed_at":"2026-08-07T12:10:01.955812Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:01.476023Z","title":"Matthew effect, 2025","venue":null,"work_id":"405c3f56-e051-4f3c-9f80-50b43a044096","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:56.067594Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:ea3cddcabd326aedb314b1334bf72ddd0ade5223460f5434754b22e5caee8377","observation_id":"d872c735-e5cf-460b-9c8f-0d29f2fec5a1","resolution":{"observed_at":"2026-08-07T12:10:01.582880Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:01.199067Z","title":"Quantifying developers’ adoption of security tools","venue":null,"work_id":"a9565565-8087-4d5f-bcd2-64d4781861db","year":2015},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:56.172761Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:f555ac625cf3f69b8c94687fe965e30d7ef4f54191d074f343c0047c94540d09","observation_id":"6987259c-cef5-4121-a8e2-7f52fc932628","resolution":{"observed_at":"2026-08-07T12:10:01.292166Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:09:56.265918Z","title":"Ethereum: A secure decentralised generalised transaction ledger.Ethereum project yellow paper, 151(2014):1–32, 2014","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:56.265918Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:d379e47dcbd4801ef5f43a8ab6b79d87ac84268248048940d63a5ebb99dc1e45","observation_id":"0121801b-0f3d-4d52-aea7-da0d4b2f9887","resolution":{"observed_at":"2026-08-07T12:09:56.265918Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:00.966000Z","title":"Bench- marking and defending against indirect prompt injection attacks on large language models","venue":null,"work_id":"fcf7fc9d-7e39-4a11-93ba-151dd648c80f","year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:56.359185Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:108efc11eec742d0bd17c769aa771cbb0410527c17d3bc3d5ae1edb9d80b369b","observation_id":"dbaea798-bea1-48dc-a217-55f72c262de4","resolution":{"observed_at":"2026-08-07T12:10:01.064864Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:00.802826Z","title":"Agent Security Bench (ASB): For- malizing and Benchmarking Attacks and Defenses in LLM-based Agents","venue":null,"work_id":"f6c8b266-9217-4382-adff-97404b644a91","year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:56.422535Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:36f88ca459eafad946648814b34995eb017bc2cb9a26e02506764adba78fdbd8","observation_id":"5ef77d01-168e-49f1-b511-b46f3c86cd67","resolution":{"observed_at":"2026-08-07T12:10:00.881229Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:00.650961Z","title":"Imperceptible content poisoning in llm-powered applications","venue":null,"work_id":"0cb585be-dd3f-4c67-800b-6d48c66c5602","year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:56.479456Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:105818af088da3ee9a56e9447f93c77aeca4a490e533788528e30e8ac7a1f092","observation_id":"49ed5e63-54bd-4b00-915f-4c11c4ef7fcd","resolution":{"observed_at":"2026-08-07T12:10:00.715757Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.07467","last_updated":"2025-04-10T05:35:21Z","snapshot_observed_at":"2026-08-13T22:56:16.234758Z","submitted_at":"2025-04-10T05:35:21Z","title":"Defense against Prompt Injection Attacks via Mixture of Encodings","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.07467","snapshot_observed_at":"2026-08-07T12:09:56.534995Z","title":"Defense against prompt injection attacks via mixture of encodings, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:56.534995Z"},"links":{"cited_paper":"/paper/2504.07467","citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:ebdeec1023a0c058999ac8e20fd4fb64a3761369fd864f45552e960c178d23bf","observation_id":"9d6c9823-9eae-4f9d-852d-bb4f1a83749f","resolution":{"observed_at":"2026-08-07T12:09:56.534995Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:09:56.622350Z","title":"Priva- cyasst: Safeguarding user privacy in tool-using large language model agents.IEEE Transactions on Depend- able and Secure Computing, 21(6):5242–5258, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:56.622350Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:2b33856057840bdfe10c80aa7cc0d9e0728d38a2441512d999fd1099bb9c007d","observation_id":"21de33de-3219-4534-a5d6-cd13cd65e023","resolution":{"observed_at":"2026-08-07T12:09:56.622350Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:00.428986Z","title":"Attacks on Third-Party APIs of Large Language Models","venue":null,"work_id":"8d24693f-0a56-4d80-b7c7-d8a37d849a00","year":2024},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:56.694429Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:254a0a85512195e675a3971e232b9e297cbb3d5efc0908e325322b921af638eb","observation_id":"238a4011-0c81-4eef-abe7-af653cfa0eeb","resolution":{"observed_at":"2026-08-07T12:10:00.548218Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:00.269643Z","title":"ETHPriceCurrentServer","venue":null,"work_id":"061e5814-6566-4843-a251-572af2ee86c1","year":2017},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:56.753056Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:fe5084b3c2bdaba017872c9415f3376f0492994df3451ff13b2292ebababbc90","observation_id":"d4bfa0ab-beab-46a8-ada6-944c9c149c8a","resolution":{"observed_at":"2026-08-07T12:10:00.325087Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:10:00.099316Z","title":"installing","venue":null,"work_id":"2b5ca9c2-5bbb-4fea-80e0-c263e2abba4c","year":null},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:56.822921Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:40316d77126d4457298f76cd3905ad80433cefb04ea4cfc2f93b6dcf149fa3a6","observation_id":"f2174626-09b5-4638-a688-ebaba8a0eeef","resolution":{"observed_at":"2026-08-07T12:10:00.192293Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:09:59.887154Z","title":null,"venue":null,"work_id":"25ca8a16-967a-4079-a164-41d6663f3b84","year":null},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:56.872735Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:4d9c141e2ead66e3184475748f9da92e47d80a1e11fe7c82790e73f414e2d5a8","observation_id":"abd55e11-3825-46a8-ba59-52c61c216e6a","resolution":{"observed_at":"2026-08-07T12:09:59.982641Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:09:59.657493Z","title":"introduction and description,","venue":null,"work_id":"ff56af1c-4db4-412b-b608-45415624438f","year":null},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:56.952812Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:9c5603562ef66530079c65fb976329ce1e12a57053ea0147f0b9c8212655b03f","observation_id":"ae2cb714-ea16-4146-aaba-aec7a5f82a6a","resolution":{"observed_at":"2026-08-07T12:09:59.777666Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:09:59.466413Z","title":null,"venue":null,"work_id":"b57194da-5fa0-46b7-8e3c-8703f52a9360","year":null},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:57.043776Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:c70d4a6c1e29d2b3ad315c4cf26fb7f0034dd38b65bf1ff685623c90ffcc80c5","observation_id":"1390b489-f521-42c6-90fa-0001fd6ee749","resolution":{"observed_at":"2026-08-07T12:09:59.548338Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:09:59.280069Z","title":null,"venue":null,"work_id":"8889336a-a7d7-4fff-a7fd-32d53f9a7519","year":null},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:57.109047Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:e1f85774faa4558c3933aff7aa0cb862e35463f2afe05875fcdfe4dc345c76f4","observation_id":"e5b18c87-7e09-4c2a-8f72-ddfb17071e90","resolution":{"observed_at":"2026-08-07T12:09:59.392909Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:09:59.003356Z","title":null,"venue":null,"work_id":"588fd8e4-e3d2-443b-afa9-f7924febae63","year":null},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:57.174121Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:f85b56754e8de88015093625ee7d44b30d033901af0741d98abf143bbc028a1d","observation_id":"0f8688da-7373-4165-9867-30f35117e968","resolution":{"observed_at":"2026-08-07T12:09:59.139758Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:09:58.706082Z","title":null,"venue":null,"work_id":"7231d3ab-f27a-4e91-81e5-d87eddf2e175","year":null},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:57.239739Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:ff38842c447af2fc6f3c57e9c79b540f61c01065335326a9a4e6ab98faecbbeb","observation_id":"956513ab-7544-4320-a3ee-d9f5f2ee2dad","resolution":{"observed_at":"2026-08-07T12:09:58.869101Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:09:58.390730Z","title":null,"venue":null,"work_id":"cc6ddb26-1ced-46bd-841e-d3241924debc","year":null},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:57.311305Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:111cd4d9395039ebd4d70922393689c630ab626524e7c2815bfefb7ac5f7d8b3","observation_id":"1cd8436e-ec79-4180-b7aa-eadfd2c41076","resolution":{"observed_at":"2026-08-07T12:09:58.559238Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:09:58.072037Z","title":null,"venue":null,"work_id":"44eb7c80-06e0-43c6-a721-21743fb889ed","year":null},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:57.375513Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:7e427b2cd851cc2888e1a20d90712abf87177bbaf331e2eb1f617dd421c1fe11","observation_id":"6cd5f8c8-7f3f-49a5-b8a4-b03fc78a5ee4","resolution":{"observed_at":"2026-08-07T12:09:58.223766Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:09:57.803231Z","title":"path\": \"/Users/thirdpc/test/env.md","venue":null,"work_id":"48b8a902-4d17-4c1b-82f8-8a5a1c3d12b4","year":null},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:57.429632Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:3768fda091a236965e88e2965fe36c4de3dd4f594ff6ab71eadf902b727f0517","observation_id":"2e286774-eb6c-4082-abdb-14896163644a","resolution":{"observed_at":"2026-08-07T12:09:57.876546Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T12:09:57.754142Z","title":"sunny\". The current date is August 20th, which is within this calibration period. The original result was","venue":null,"work_id":"424311bc-ca12-4185-838a-7507b5f8c5dd","year":null},"citing_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-07T12:09:57.476890Z"},"links":{"citing_paper":"/paper/2506.02040"},"observation_digest":"sha256:31c31c48415c2b0c34a1944c58e0a6ed660518a99ba36ec536f439c0301d9984","observation_id":"28eb71d1-7e95-416d-a4a8-829485386189","resolution":{"observed_at":"2026-08-07T12:09:57.792007Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","latest_version":4,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem"},"reference_resolution":{"displayed":74,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":20,"verified_exact":0,"verified_fuzzy":54},"total_outbound_references":74},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"thesis":"As of 14 August 2026, this Paper Citation Record lists 74 of 74 outbound references and 23 inbound Pith citation observations for arXiv:2506.02040."}