{"as_of":"2026-08-05T01:16:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:23940f8512c228d6345961e294e3f40549266313facfb68388b23eeac8e7e185","coverage":[{"denominator":0,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":32,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":32,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-04T06:34:03.388597+00:00","state":"measured"},{"denominator":32,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":32,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-04T08:06:09.223677Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-07-10T12:27:04.097770Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2504.19793","last_updated":"2025-08-24T03:28:21Z","snapshot_observed_at":"2026-08-01T07:24:09.967062Z","submitted_at":"2025-04-28T13:36:43Z","title":"Prompt Injection Attack to Tool Selection in LLM Agents","version":3},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-05-16T17:08:28.933831Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2504.19793"},"observation_digest":"sha256:4d666b78b717096d7f7a8d3f761d67276168161abef5f4a5abaa1fa99cd93d04","observation_id":"3035d91c-4bf4-4a01-b1b6-44cd415829a1","resolution":{"observed_at":"2026-05-16T17:08:29.063576Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-08-04T08:06:09.223677Z","title":"Design patterns for securing llm agents against prompt injections.arXiv preprint arXiv:2506.08837, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.22963","last_updated":"2026-06-19T20:25:06Z","snapshot_observed_at":"2026-08-04T08:06:05.944327Z","submitted_at":"2025-10-27T03:37:41Z","title":"When Compression Becomes an Attack Surface: Black-Box Attacks on Prompt-Compressed LLM Agents","version":4},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-04T08:06:09.223677Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2510.22963"},"observation_digest":"sha256:7651755338b8b3724eb2699e215a127eb3e09bc22c6b758f650f118cd46c80ba","observation_id":"557428b5-3b14-4f23-8503-e7b4b2f00627","resolution":{"observed_at":"2026-08-04T08:06:09.223677Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2510.23883","last_updated":"2026-04-03T16:27:34Z","snapshot_observed_at":"2026-08-02T13:42:34.526072Z","submitted_at":"2025-10-27T21:48:11Z","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","version":3},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-05-18T03:42:10.703369Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2510.23883"},"observation_digest":"sha256:f9b34e95b0f35f4638436388d239fee7255da59601e8306fea7e2f2408b87644","observation_id":"421e278b-f1e9-433b-a767-52f1e0f20db0","resolution":{"observed_at":"2026-05-18T03:42:22.528614Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-08-04T07:01:14.483509Z","title":"Beurer-Kellner, B","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.27275","last_updated":"2026-07-30T09:01:41Z","snapshot_observed_at":"2026-08-04T07:01:12.635549Z","submitted_at":"2025-10-31T08:35:42Z","title":"Prevalence of Security and Privacy Risk-Inducing Usage of AI-based Conversational Agents","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-04T07:01:14.483509Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2510.27275"},"observation_digest":"sha256:a708de53be8b827cf7b4bef8770c610cd5c3b98fb6083cfad8f5a7dec0b72e1a","observation_id":"ca0e399b-891b-47bc-8350-aca7d93946ee","resolution":{"observed_at":"2026-08-04T07:01:14.483509Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2512.06556","last_updated":"2026-05-21T13:44:50Z","snapshot_observed_at":"2026-07-06T22:37:59.340166Z","submitted_at":"2025-12-06T20:07:58Z","title":"Semantic Attacks on Tool-Augmented LLMs: Securing the Model Context Protocol Against Descriptor-Level Manipulation","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-22T12:46:44.819224Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2512.06556"},"observation_digest":"sha256:8fcf6e914a1bc16d30671b492fac79124af793aa0b82786b4c3e9b970e967ed0","observation_id":"fcd2aeea-d216-45cd-9b46-e6ef4820eb08","resolution":{"observed_at":"2026-05-22T12:51:33.451649Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2603.00991","last_updated":"2026-05-07T14:09:04Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2026-03-01T08:39:37Z","title":"Tracking Capabilities for Safer Agents","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-15T18:31:34.181629Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2603.00991"},"observation_digest":"sha256:f344b0933ec23f47ba84ada2f2ec47cba3e5f431379627f999455d02cfbb2293","observation_id":"349bed18-f6e7-40a0-865b-88bc47d9813f","resolution":{"observed_at":"2026-05-15T18:36:29.247485Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2604.15368","last_updated":"2026-04-15T04:32:36Z","snapshot_observed_at":"2026-07-06T23:02:58.361418Z","submitted_at":"2026-04-15T04:32:36Z","title":"LogJack: Indirect Prompt Injection Through Cloud Logs Against LLM Debugging Agents","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-05-10T13:51:49.515947Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2604.15368"},"observation_digest":"sha256:5d74c82c70472b2f2e45eb7f79ef882ea2a3cbe1c9d75e1a22d2e7a4a5082c50","observation_id":"f47ad6d8-a9d1-4e8f-9fd3-bd17c9c387a4","resolution":{"observed_at":"2026-05-10T13:55:29.084211Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2605.00081","last_updated":"2026-04-30T14:38:05Z","snapshot_observed_at":"2026-07-06T23:13:33.799847Z","submitted_at":"2026-04-30T14:38:05Z","title":"Alignment Contracts for Agentic Security Systems","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-09T20:47:28.506174Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2605.00081"},"observation_digest":"sha256:2d084ec886866ca645ac4008d9abefc27f0bc123b5a0b032018ef394c4c730f8","observation_id":"bbefcaaa-25ed-46d3-8971-260da12cc5e5","resolution":{"observed_at":"2026-05-11T15:01:04.910407Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2605.01970","last_updated":"2026-05-15T06:42:15Z","snapshot_observed_at":"2026-07-06T23:15:07.159340Z","submitted_at":"2026-05-03T17:07:20Z","title":"Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration","version":3},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-19T17:30:22.481943Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2605.01970"},"observation_digest":"sha256:6f23002ecfe96a7801d1790e62b151d45b8533f106d6ebad4708611e03702301","observation_id":"d3f339d7-4ece-4549-8ea7-e862d4488316","resolution":{"observed_at":"2026-05-19T17:32:41.588564Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2605.11868","last_updated":"2026-05-12T09:48:53Z","snapshot_observed_at":"2026-07-06T23:23:39.723268Z","submitted_at":"2026-05-12T09:48:53Z","title":"IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-13T05:46:07.132408Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2605.11868"},"observation_digest":"sha256:ebac1f14e903576d34f1fe27717f0051e08ade236c01be2b0447c2181e34ca78","observation_id":"fbe41ca5-0fc7-48cf-935c-9ebc11b9416d","resolution":{"observed_at":"2026-05-13T05:47:21.309927Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2605.14290","last_updated":"2026-05-14T02:48:57Z","snapshot_observed_at":"2026-08-03T04:50:16.568616Z","submitted_at":"2026-05-14T02:48:57Z","title":"Web Agents Should Adopt the Plan-Then-Execute Paradigm","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-15T02:42:05.644536Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2605.14290"},"observation_digest":"sha256:07b5e21837eb59a1c982f9e708875d2e9208d45b2cb77ae14b80a40f11202d09","observation_id":"89d9bc78-ec48-46d0-b108-58bea1a2e519","resolution":{"observed_at":"2026-05-15T02:43:33.372927Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2605.18784","last_updated":"2026-05-06T13:24:44Z","snapshot_observed_at":"2026-07-06T23:29:38.069295Z","submitted_at":"2026-05-06T13:24:44Z","title":"The Insurability Frontier of AI Risk: Mapping Threats to Affirmative Coverage, Silent Exposures, and Exclusions","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-20T23:30:39.514339Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2605.18784"},"observation_digest":"sha256:e7ba6871c23970b67f6ca5493bf32789a085769d061920b17a87cc55c9e6714a","observation_id":"6a4a398c-ba3c-4d78-baae-139ba393d87d","resolution":{"observed_at":"2026-05-20T23:33:50.920592Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2606.02080","last_updated":"2026-06-01T11:10:28Z","snapshot_observed_at":"2026-07-06T23:42:30.555538Z","submitted_at":"2026-06-01T11:10:28Z","title":"Agentic-J: An AI Agent for Biological Microscopy Image Analysis","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-06-28T11:48:11.033570Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2606.02080"},"observation_digest":"sha256:9ea4d183eba4e8a00ddc1777a9a6a865d203b7a7a9ba7b539264510735cedcc5","observation_id":"ffd7a805-ebec-4f09-9b6c-9e37d5f969bc","resolution":{"observed_at":"2026-07-02T01:36:25.311723Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2606.02668","last_updated":"2026-06-01T11:08:17Z","snapshot_observed_at":"2026-07-06T23:43:02.654629Z","submitted_at":"2026-06-01T11:08:17Z","title":"What You Approve Is What Executes: Consent Integrity for Black-Box LLM Agents","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-06-28T14:12:38.815852Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2606.02668"},"observation_digest":"sha256:42d2f3eb0bbfe5be218510a2fe0cd9b7ca572907d2f0779bbb3a6b81f69d9ec9","observation_id":"fed40526-eb57-4b76-8c65-afe923f74566","resolution":{"observed_at":"2026-07-01T23:36:22.921717Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2606.05679","last_updated":"2026-06-04T04:01:24Z","snapshot_observed_at":"2026-08-03T00:29:19.443809Z","submitted_at":"2026-06-04T04:01:24Z","title":"Data Flow Control: Data Safety Policies for AI Agents","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-06-27T23:28:47.480408Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2606.05679"},"observation_digest":"sha256:47417432472a539e258b2e5634369e68fec302dff2b0d1ab5a72fcae902c4c3e","observation_id":"529405dc-6e36-4f9c-b92c-19ed75aaf16e","resolution":{"observed_at":"2026-07-02T15:47:06.357233Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2606.10322","last_updated":"2026-06-09T02:18:44Z","snapshot_observed_at":"2026-08-01T07:26:53.142922Z","submitted_at":"2026-06-09T02:18:44Z","title":"Game-Theoretic Multi-Agent Control for Robust Contextual Reasoning in LLMs","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-06-27T13:05:57.618969Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2606.10322"},"observation_digest":"sha256:756551e5a9f6e7b30247f5f75d83e5d944eb0f6dbe5ac541dd3cec00044c7c80","observation_id":"8a55b5ac-366f-45b3-a23c-3a2fafee5c79","resolution":{"observed_at":"2026-07-03T05:47:41.197854Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2606.10749","last_updated":"2026-06-09T12:01:07Z","snapshot_observed_at":"2026-07-31T21:35:18.696472Z","submitted_at":"2026-06-09T12:01:07Z","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-06-27T12:55:22.831264Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2606.10749"},"observation_digest":"sha256:13182aa07579131ca2b985dd3744916d45379d2942502782065f074beb3aefea","observation_id":"d22383bd-4dfc-4893-ba75-e1253cb95ee9","resolution":{"observed_at":"2026-06-27T13:20:57.094470Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2606.22504","last_updated":"2026-06-21T13:52:37Z","snapshot_observed_at":"2026-08-03T05:56:41.516003Z","submitted_at":"2026-06-21T13:52:37Z","title":"Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-06-26T10:13:31.405238Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2606.22504"},"observation_digest":"sha256:202d194af39a7a2f8d401b4cfae8d246cd9bfedff9e98ac6b1b97b7ffb381355","observation_id":"175a722a-4c15-427e-a3a4-068bbe2d7335","resolution":{"observed_at":"2026-07-04T09:19:43.605487Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2606.23277","last_updated":"2026-06-22T12:54:04Z","snapshot_observed_at":"2026-08-02T06:21:16.386788Z","submitted_at":"2026-06-22T12:54:04Z","title":"GIF: Locally Sound Geometric Information Flow Control for LLMs","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-06-26T08:24:49.908288Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2606.23277"},"observation_digest":"sha256:802f0fe72be62678c975da6d3f83387e2dad3448cb9cc0f731b14f327bf3aabd","observation_id":"b459f59e-ff63-4e41-8a1d-357c3c82495c","resolution":{"observed_at":"2026-07-04T10:49:46.741547Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2606.26479","last_updated":"2026-06-25T00:35:23Z","snapshot_observed_at":"2026-07-07T00:00:46.505337Z","submitted_at":"2026-06-25T00:35:23Z","title":"Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-06-26T04:58:59.046289Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2606.26479"},"observation_digest":"sha256:4479da7785787e2b26ff077f4db5eea466e0d09fbbeb350bfac0f1883eee85f3","observation_id":"7dcc35be-7d05-4c3f-9094-c9f53153b919","resolution":{"observed_at":"2026-07-04T13:39:51.328735Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2606.26627","last_updated":"2026-06-25T05:44:18Z","snapshot_observed_at":"2026-08-02T09:36:56.612724Z","submitted_at":"2026-06-25T05:44:18Z","title":"Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-06-26T04:29:16.386339Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2606.26627"},"observation_digest":"sha256:a8cb103b95d0fa8bdd901b064d8d1f52613c38b778ad1481ac1d8fc0aa6dcbfa","observation_id":"808a4815-8a81-4ea8-9eaf-80a9b706cf7f","resolution":{"observed_at":"2026-07-04T14:09:53.262547Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2607.01510","last_updated":"2026-07-01T22:17:34Z","snapshot_observed_at":"2026-08-02T18:59:31.633775Z","submitted_at":"2026-07-01T22:17:34Z","title":"Janus: a Playground for User-Involved Agentic Permission Management","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-07-03T20:06:32.891096Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2607.01510"},"observation_digest":"sha256:f4c692e6562bd026f6a0bb4ca8fe042583dedfad9ee6b7d8f70cb10ca541c251","observation_id":"2f4644b6-c99c-416d-b7c3-1d0252e42811","resolution":{"observed_at":"2026-07-03T20:08:54.778632Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-11T19:34:52.611804Z","title":"Robustly Incentive Compatible Task Allocation for Agents with Textually Self- Described Skills","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.04382","last_updated":"2026-07-05T16:15:18Z","snapshot_observed_at":"2026-07-11T19:34:47.796269Z","submitted_at":"2026-07-05T16:15:18Z","title":"Beyond Self-Resolution: Settlement Factorization for Robust Natural Language Mechanism","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-07-11T19:34:52.611804Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2607.04382"},"observation_digest":"sha256:98ffa03584d21262eff95fb907bb987d7e296e6b064b3d2c4f2d71b8e247566b","observation_id":"a45d9e9d-2c75-464b-8052-b1b799c2e4ff","resolution":{"observed_at":"2026-07-11T19:34:52.611804Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Design patterns for securing llm agents against prompt injections,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-02T10:04:29.242395Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:ab35c40368cac38a19ac8e61ec956a4e688239d0ace43da96b6bb2064118848a","observation_id":"9eb4f866-d0b6-498b-bfa0-d98b81f35732","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-10T12:27:04.097770Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-07-30T10:00:34.422581Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:76d9c5d697b233f8a12b156fd306965cbf86a8607b417442a1227bf69f3bf3bd","observation_id":"bfd5d8d7-340e-4927-ae45-9a02af7cf509","resolution":{"observed_at":"2026-07-10T12:27:04.099528Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-08-02T05:10:09.289891Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.13453","last_updated":"2026-07-15T05:26:43Z","snapshot_observed_at":"2026-08-02T05:10:09.037995Z","submitted_at":"2026-07-15T05:26:43Z","title":"Adversarial Prompting Framework for AI Safety Assessment","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-02T05:10:09.289891Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2607.13453"},"observation_digest":"sha256:b3738d0e981a43da7aa5d2e369118cc441ab266d6a580e2ec4993ddf158205fc","observation_id":"ecb94da7-7e5f-41c0-91a9-11c532e3b281","resolution":{"observed_at":"2026-08-02T05:10:09.289891Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-08-01T18:40:55.397024Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17225","last_updated":"2026-07-19T12:27:39Z","snapshot_observed_at":"2026-08-01T18:40:53.959269Z","submitted_at":"2026-07-19T12:27:39Z","title":"Specifying the Delegated-Autonomy Boundary: Requirements Engineering for Agentic AI","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-01T18:40:55.397024Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2607.17225"},"observation_digest":"sha256:44de439f598df8f77869f4d1e857f14dd485a9f749ccf80f31f1ab5e23f91794","observation_id":"f09d9082-5519-4344-9b07-828395f81160","resolution":{"observed_at":"2026-08-01T18:40:55.397024Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-08-01T09:30:52.016053Z","title":"Design patterns for securing LLM agents against prompt injections,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.20759","last_updated":"2026-07-22T22:20:02Z","snapshot_observed_at":"2026-08-04T00:17:22.539121Z","submitted_at":"2026-07-22T22:20:02Z","title":"IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-01T09:30:52.016053Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2607.20759"},"observation_digest":"sha256:258d0ea3816309b4b2fe159e04e1f329a3fe3dfbe7d11e6fa75855d0ef68bf9e","observation_id":"77f03a05-7c8b-4407-a4f2-162945b4802f","resolution":{"observed_at":"2026-08-01T09:30:52.016053Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-08-01T06:04:46.261016Z","title":"arXiv preprint arXiv:2506.08837 , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.22024","last_updated":"2026-07-24T06:43:09Z","snapshot_observed_at":"2026-08-04T13:13:46.028018Z","submitted_at":"2026-07-24T06:43:09Z","title":"Agent Security Needs Redefinition through a Holistic Framework","version":1},"reference_index":197,"source":"arxiv_source","source_observed_at":"2026-08-01T06:04:46.261016Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2607.22024"},"observation_digest":"sha256:18d59bde1d8a793b8ff4e07b25282ba35fc5ad5b592d372d78f0af644a507f19","observation_id":"b169d889-a5d9-4a70-a222-129b8d5ea01f","resolution":{"observed_at":"2026-08-01T06:04:46.261016Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-30T18:16:45.183096Z","title":"Design patterns for securing llm agents against prompt injections,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.23586","last_updated":"2026-07-26T10:29:20Z","snapshot_observed_at":"2026-08-03T02:20:43.034604Z","submitted_at":"2026-07-26T10:29:20Z","title":"Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-30T18:16:45.183096Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2607.23586"},"observation_digest":"sha256:fce12b621cd0c106021100c206997fcfee281a0b36aee66e97c486bd70b86b7f","observation_id":"4a235574-ca91-4afd-836c-fa9a52b7f157","resolution":{"observed_at":"2026-07-30T18:16:45.183096Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-30T12:03:18.274762Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.23804","last_updated":"2026-07-26T19:06:29Z","snapshot_observed_at":"2026-07-30T23:56:46.291303Z","submitted_at":"2026-07-26T19:06:29Z","title":"How Context Attribution Handles What the Model Already Knows","version":1},"reference_index":54,"source":"arxiv_source","source_observed_at":"2026-07-30T12:03:18.274762Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2607.23804"},"observation_digest":"sha256:ef7b771e2190efc4a878a48aa673018ee8b3ad8a746213d2c1fa11658fdfe1d1","observation_id":"77238753-6243-414d-9a2a-f05a02807625","resolution":{"observed_at":"2026-07-30T12:03:18.274762Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-31T02:04:06.710922Z","title":"Luca Beurer-Kellner, Beat Buesser, Ana-Maria Cre¸ tu, Edoardo Debenedetti, Daniel Dobos, Daniel Fabian, Marc Fischer, David Froelicher, Kathrin Grosse, Daniel Naeff, et al","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.28617","last_updated":"2026-07-30T17:58:58Z","snapshot_observed_at":"2026-08-03T10:15:06.066795Z","submitted_at":"2026-07-30T17:58:58Z","title":"AISPA: User-Centric System Prompt Auditing for Large Language Model Applications","version":1},"reference_index":2026,"source":"pdf_text","source_observed_at":"2026-07-31T02:04:06.710922Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2607.28617"},"observation_digest":"sha256:ff40eda79c00faec2772429a6feb4d7587859cc59f062b14646f6ede661cfdbd","observation_id":"372f391f-490e-4885-a115-6d34b9a4b96a","resolution":{"observed_at":"2026-07-31T02:04:06.710922Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2506.08837/citation-record","integrity":"/paper/2506.08837/integrity","json":"/paper/2506.08837/citation-record.json","paper":"/paper/2506.08837"},"outbound":[],"paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","latest_version":3,"primary_category":"cs.LG","snapshot_observed_at":"2026-07-06T21:39:47.521007Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections"},"reference_resolution":{"displayed":0,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":0},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"thesis":"As of 5 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 32 inbound Pith citation observations for arXiv:2506.08837."}