{"as_of":"2026-08-19T17:45:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:12853d371bfc0ccf26d06e46cf8ec2a25c5677c5000b350059110a1c2f8ea357","coverage":[{"denominator":1,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":1,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T18:59:53.055489Z","state":"measured"},{"denominator":34,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":34,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-19T06:32:44.657259+00:00","state":"measured"},{"denominator":33,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":33,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-15T19:23:24.332483Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"pith","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"pith"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T18:59:53.055489Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-05T18:59:53.055489Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2508.14925"},"observation_digest":"sha256:b150e23243684edcaae1f15bd5bf51cd8c5c78f2e4eca3195fa18d689606113b","observation_id":"74f68912-7c38-4f8f-9b1d-db5eb8c2db34","resolution":{"observed_at":"2026-08-05T18:59:53.055489Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2509.06572","last_updated":"2026-05-01T11:41:26Z","snapshot_observed_at":"2026-08-14T23:56:29.912718Z","submitted_at":"2025-09-08T11:35:32Z","title":"Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem","version":5},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-05-18T18:43:35.072919Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2509.06572"},"observation_digest":"sha256:80f81ad55add4eae69c083d69780ed60a1b499d078c072b57f4a41f855cfd4e9","observation_id":"63e9ffe8-108a-41c2-89b7-9223ea87983a","resolution":{"observed_at":"2026-05-18T18:46:45.305941Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-03T12:56:37.789590Z","title":"Mcptox: A benchmark for tool poisoning attack on real-world mcp servers,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2601.01241","last_updated":"2026-06-22T15:20:42Z","snapshot_observed_at":"2026-08-19T09:33:33.369450Z","submitted_at":"2026-01-03T17:25:38Z","title":"MCP-SandboxScan: WASM-based Secure Execution and Runtime Analysis for MCP Tools","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-03T12:56:37.789590Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2601.01241"},"observation_digest":"sha256:74fe8c9fa93bac60a54ca8b7d477acee5cd3fb13889313b4563a264d9f6d0040","observation_id":"280f776d-be11-4d24-ac11-78371288c7bd","resolution":{"observed_at":"2026-08-03T12:56:37.789590Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2603.13417","last_updated":"2026-03-12T17:42:24Z","snapshot_observed_at":"2026-08-15T05:54:42.819292Z","submitted_at":"2026-03-12T17:42:24Z","title":"Bridging Protocol and Production: Design Patterns for Deploying AI Agents with Model Context Protocol","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-15T11:58:18.020389Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2603.13417"},"observation_digest":"sha256:6b58a2cd09c98c2ad0e01affbc7cb76860c18d2907a1132671b83ac324951f9a","observation_id":"5ad4840d-8d02-4b3b-84ab-d6e80204cc48","resolution":{"observed_at":"2026-05-15T11:59:59.368965Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2604.03131","last_updated":"2026-04-03T15:52:36Z","snapshot_observed_at":"2026-08-14T16:44:17.946235Z","submitted_at":"2026-04-03T15:52:36Z","title":"A Systematic Security Evaluation of OpenClaw and Its Variants","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-13T19:33:29.341895Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2604.03131"},"observation_digest":"sha256:806744a20ff0b99fe197a7c293ab174808d887925615266d46a221b1f0566637","observation_id":"4f6be4f1-d1b5-4026-ad19-0902aa710d67","resolution":{"observed_at":"2026-05-13T19:38:10.680308Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2604.04426","last_updated":"2026-04-06T05:15:00Z","snapshot_observed_at":"2026-08-17T17:46:31.291606Z","submitted_at":"2026-04-06T05:15:00Z","title":"ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systems","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-10T20:25:58.113363Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2604.04426"},"observation_digest":"sha256:7e4421c1464c04bbaad7283e68b35e87b290415f6feaeffa67a659c2db2e1c67","observation_id":"b2136d16-8ffc-47ea-b3c5-a8d0aefd8508","resolution":{"observed_at":"2026-05-10T21:55:53.026950Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-08-11T04:23:46.286452Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:64cafd02a13884d0d729054ed70e62a7ced416959441ebbc027282bf97473aa4","observation_id":"f07e0b5e-6a0b-4a0f-b2b8-b5390e8e0a91","resolution":{"observed_at":"2026-05-10T23:05:49.116124Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2604.05969","last_updated":"2026-04-07T15:02:47Z","snapshot_observed_at":"2026-08-13T07:58:46.587028Z","submitted_at":"2026-04-07T15:02:47Z","title":"A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-10T19:39:27.982512Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2604.05969"},"observation_digest":"sha256:3c8a32657652c61a916e72cdc1e371d86385ae2a75431285fbc14eaf0be0dd53","observation_id":"e9743a8a-b306-4736-8a05-51ad514ae750","resolution":{"observed_at":"2026-05-10T22:40:50.288852Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2604.07551","last_updated":"2026-04-08T19:53:26Z","snapshot_observed_at":"2026-08-15T04:36:06.031902Z","submitted_at":"2026-04-08T19:53:26Z","title":"MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Security","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-05-10T17:10:50.283791Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2604.07551"},"observation_digest":"sha256:9155b914a1f30e955f45e4df0fc765965c7bd7801dd12dfa585603d28a561466","observation_id":"6de11461-dfc6-4a74-9244-8368755b80d4","resolution":{"observed_at":"2026-05-10T21:10:46.940903Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2604.11790","last_updated":"2026-05-11T16:09:04Z","snapshot_observed_at":"2026-08-12T15:01:26.208104Z","submitted_at":"2026-04-13T17:55:11Z","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-05-10T16:05:47.517157Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2604.11790"},"observation_digest":"sha256:0228ddba514d5620d9c7ec2e867c1bfb83314064f6350baa8bf9dff830c0eb36","observation_id":"5e074be1-2a67-4a94-a846-26556f984d7e","resolution":{"observed_at":"2026-05-11T09:20:59.960245Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2604.11790","last_updated":"2026-05-11T16:09:04Z","snapshot_observed_at":"2026-08-12T15:01:26.208104Z","submitted_at":"2026-04-13T17:55:11Z","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","version":2},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-05-12T04:17:07.080092Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2604.11790"},"observation_digest":"sha256:6c786c9dcbacd060cebca8dc75f13ef1d5e017092341c214429cbe7f92f73358","observation_id":"9089443f-c93e-48a5-8b0f-cda089c4f70e","resolution":{"observed_at":"2026-05-12T06:26:25.210503Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2604.17125","last_updated":"2026-04-18T19:53:09Z","snapshot_observed_at":"2026-08-13T21:00:12.704743Z","submitted_at":"2026-04-18T19:53:09Z","title":"CASCADE: A Cascaded Hybrid Defense Architecture for Prompt Injection Detection in MCP-Based Systems","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-10T06:07:01.732928Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2604.17125"},"observation_digest":"sha256:a769a65316fa38aba121cfd8924e386b74f5463c9fac35e6c1c6d7a975c58c57","observation_id":"a8b738dc-2e96-4193-a5ba-bbb4fcffa7e5","resolution":{"observed_at":"2026-05-10T06:11:20.456096Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2605.09822","last_updated":"2026-05-10T23:55:13Z","snapshot_observed_at":"2026-08-17T23:57:37.820842Z","submitted_at":"2026-05-10T23:55:13Z","title":"Oracle Poisoning: Corrupting Knowledge Graphs to Weaponise AI Agent Reasoning","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-12T02:27:06.805794Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2605.09822"},"observation_digest":"sha256:005e6f88595d3bd5a8873bf02b6f5aed2de528bb97cc120d0bb8ad970c1bd082","observation_id":"43b36547-6ae3-4f89-b79f-cf1cb2a10430","resolution":{"observed_at":"2026-05-12T07:37:04.063019Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2605.11053","last_updated":"2026-05-22T06:52:48Z","snapshot_observed_at":"2026-08-11T13:07:03.416071Z","submitted_at":"2026-05-11T14:55:48Z","title":"Content-Aware Attack Detection in LLM Agent Tool-Call Traffic: An Empirical Study of Features, Architectures, and Evaluation Protocols","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-13T00:56:02.786795Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2605.11053"},"observation_digest":"sha256:486c99284c734f11e71c4236503268bac7a9bd7ff4aa287f8aef3d64e9f81664","observation_id":"eafed71a-bbc8-4adf-8993-ad0ed76593c3","resolution":{"observed_at":"2026-05-13T00:57:00.345076Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2605.11053","last_updated":"2026-05-22T06:52:48Z","snapshot_observed_at":"2026-08-11T13:07:03.416071Z","submitted_at":"2026-05-11T14:55:48Z","title":"Content-Aware Attack Detection in LLM Agent Tool-Call Traffic: An Empirical Study of Features, Architectures, and Evaluation Protocols","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-14T21:17:10.373607Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2605.11053"},"observation_digest":"sha256:49351263df2ddd3dfe79c1078052bcc2967d85f78496caf3ef4106e3255d4424","observation_id":"7a5c36b5-6d15-46e6-918c-a3bacf590c57","resolution":{"observed_at":"2026-05-14T21:17:58.633112Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2605.11053","last_updated":"2026-05-22T06:52:48Z","snapshot_observed_at":"2026-08-11T13:07:03.416071Z","submitted_at":"2026-05-11T14:55:48Z","title":"Content-Aware Attack Detection in LLM Agent Tool-Call Traffic: An Empirical Study of Features, Architectures, and Evaluation Protocols","version":3},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-25T05:57:22.726910Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2605.11053"},"observation_digest":"sha256:711274f632a370be1dbcf2c01c997869d8b82e32adf980a3af431705aeabf35d","observation_id":"0bcc9a05-4e61-4fe2-be25-3c2f554c5d92","resolution":{"observed_at":"2026-05-25T06:00:23.541536Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2605.11781","last_updated":"2026-05-12T08:49:10Z","snapshot_observed_at":"2026-08-15T04:02:43.250265Z","submitted_at":"2026-05-12T08:49:10Z","title":"Five Attacks on x402 Agentic Payment Protocol","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-13T05:51:03.724580Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2605.11781"},"observation_digest":"sha256:855815cb33a3e159cd1b238c42a9cd56d6a46059fd65728253b1ccbc3b13a01a","observation_id":"b57b6ff4-4735-4c6c-bd57-5309cd075be4","resolution":{"observed_at":"2026-05-13T05:52:22.105049Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2605.16471","last_updated":"2026-05-15T13:53:02Z","snapshot_observed_at":"2026-08-14T00:09:46.311940Z","submitted_at":"2026-05-15T13:53:02Z","title":"From AI-Generated Content to Agentic Action: Security and Safety Threats in Generative AI","version":1},"reference_index":137,"source":"pdf_text","source_observed_at":"2026-05-20T18:08:24.901025Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2605.16471"},"observation_digest":"sha256:1e194e6ce6ee61484071e1fc832a801bc37c3e0ffa8dfba8d8493a6f04ebfc58","observation_id":"134c0bd8-f035-4a6c-9a87-648ce23b9738","resolution":{"observed_at":"2026-05-20T18:08:50.435308Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-15T04:30:18.612754Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:4b0d6db17ee50305d32c222184d568a58a3c6c6d409bde8cd9ffc5b19dabf83d","observation_id":"ed513a7c-7cfb-4e25-9757-4157bba206be","resolution":{"observed_at":"2026-05-19T23:27:52.575901Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2605.23330","last_updated":"2026-05-22T07:45:04Z","snapshot_observed_at":"2026-08-13T20:49:19.375304Z","submitted_at":"2026-05-22T07:45:04Z","title":"Security, Privacy, and Ethical Risks in OpenClaw","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-25T04:25:49.102385Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2605.23330"},"observation_digest":"sha256:34a2307599ec0a88306cc24c42dc832a3159b600977472ea4bd1d600483b6473","observation_id":"af80a512-1d00-4f55-a30f-11138deb5572","resolution":{"observed_at":"2026-05-25T04:26:37.695288Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2605.24069","last_updated":"2026-05-22T08:34:48Z","snapshot_observed_at":"2026-08-16T13:24:50.832988Z","submitted_at":"2026-05-22T08:34:48Z","title":"When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-06-30T16:22:23.857438Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2605.24069"},"observation_digest":"sha256:fdd0f7cb54ba1517bd2d62646d54e15fa366cd888b3045ea21ecba66b510a077","observation_id":"cdb55672-5b6a-4da0-bf83-09e15e5a578a","resolution":{"observed_at":"2026-06-30T16:24:55.050510Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2606.00566","last_updated":"2026-05-30T06:38:41Z","snapshot_observed_at":"2026-07-06T23:41:15.410587Z","submitted_at":"2026-05-30T06:38:41Z","title":"Same Payload, Different Channel: Measuring Trust Asymmetry in Tool-Using Language Models","version":1},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-06-28T19:19:17.673497Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2606.00566"},"observation_digest":"sha256:f3d29b8f39ac8d13a82ad956e11cbfe94581cb0e726d6964f12113fb65651118","observation_id":"d77bd3ab-780d-4b1e-be5d-e03684c2350f","resolution":{"observed_at":"2026-06-28T19:22:34.421669Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2606.02668","last_updated":"2026-06-01T11:08:17Z","snapshot_observed_at":"2026-07-06T23:43:02.654629Z","submitted_at":"2026-06-01T11:08:17Z","title":"What You Approve Is What Executes: Consent Integrity for Black-Box LLM Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-06-28T14:12:38.815852Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2606.02668"},"observation_digest":"sha256:48b9178bb46555a7039a8ef010c0508b4f7ddabd212e7b4fab3d81c945e5031a","observation_id":"56855ef6-7237-4d8a-a0d3-cc662f613dfb","resolution":{"observed_at":"2026-07-01T23:36:22.950725Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2606.04769","last_updated":"2026-06-03T11:51:32Z","snapshot_observed_at":"2026-08-07T05:41:54.273885Z","submitted_at":"2026-06-03T11:51:32Z","title":"Description-Code Inconsistency in Real-world MCP Servers: Measurement, Detection, and Security Implications","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-06-28T05:57:36.882346Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2606.04769"},"observation_digest":"sha256:7a8aaa43dcafdcef27bcbc378e94078ad0300463321d112afa7db8f4cbd04a62","observation_id":"30496f84-987f-4837-977d-f10af2c875f5","resolution":{"observed_at":"2026-07-02T08:36:47.849562Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2606.20922","last_updated":"2026-06-18T20:31:08Z","snapshot_observed_at":"2026-08-03T14:06:23.532934Z","submitted_at":"2026-06-18T20:31:08Z","title":"Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning","version":1},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-06-26T16:32:09.625729Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2606.20922"},"observation_digest":"sha256:3df0bce6a98b68c4d3b644a654a700aa0e46240e637b22c7eecb65dedac43a57","observation_id":"46979fa4-ae33-4eac-bec3-c99537fec36a","resolution":{"observed_at":"2026-07-04T04:59:36.366539Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2606.22504","last_updated":"2026-06-21T13:52:37Z","snapshot_observed_at":"2026-08-12T16:08:21.984357Z","submitted_at":"2026-06-21T13:52:37Z","title":"Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-06-26T10:13:31.405238Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2606.22504"},"observation_digest":"sha256:837398282431fe258504e6cae916940a105a380fbd4c9473017cba27fae8f097","observation_id":"8f8612d3-5e29-43fa-bafd-57e9560a459b","resolution":{"observed_at":"2026-07-04T09:19:43.601015Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-07-11T21:22:51.640124Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.04146","last_updated":"2026-07-05T07:14:56Z","snapshot_observed_at":"2026-08-19T15:05:08.554166Z","submitted_at":"2026-07-05T07:14:56Z","title":"!Imperio, smolVLA: The Implications of Data Poisoning on Open Source Robotics","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-07-11T21:22:51.640124Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2607.04146"},"observation_digest":"sha256:2c4276fa76bc93693636fb408cfd5a7b642f1d7da506d4de016eb258c6763ce4","observation_id":"0203a68e-7eb9-4579-a41c-4795d7cdbb4a","resolution":{"observed_at":"2026-07-11T21:22:51.640124Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2607.05744","last_updated":"2026-07-07T02:01:44Z","snapshot_observed_at":"2026-08-18T13:08:06.102856Z","submitted_at":"2026-07-07T02:01:44Z","title":"Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations","version":1},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-07-11T02:40:13.068295Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2607.05744"},"observation_digest":"sha256:1eebaf174babcee3487868e56f47cde2acd7a41e59238623961036bc452fb80d","observation_id":"fe764729-0262-4633-9e61-773d06580b74","resolution":{"observed_at":"2026-07-11T02:47:51.220579Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-07-14T07:09:56.559355Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.11086","last_updated":"2026-07-13T04:55:16Z","snapshot_observed_at":"2026-08-18T22:52:02.783939Z","submitted_at":"2026-07-13T04:55:16Z","title":"Rethinking MCP Security: A Large-Scale Study of Runtime MCP Servers and Security Scanner Reliability","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-07-14T07:09:56.559355Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2607.11086"},"observation_digest":"sha256:fed0463082d6f9ac0d4866aa88ba65b3b4bc3c58a3c9ef49eb84062d824c0e2c","observation_id":"055f4f6f-9039-42e0-9bd4-0ceebc8b5744","resolution":{"observed_at":"2026-07-14T07:09:56.559355Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-02T01:12:23.830265Z","title":"MCPTox: A benchmark for tool poisoning attack on real-world MCP servers,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14754","last_updated":"2026-07-16T09:41:17Z","snapshot_observed_at":"2026-08-17T08:53:23.697902Z","submitted_at":"2026-07-16T09:41:17Z","title":"FlowGuard: From Signals to Evidence for MCP Security Detection","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-02T01:12:23.830265Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2607.14754"},"observation_digest":"sha256:64bdfee3299446c6d71d4404cb20c1ab745553f788be340ede376f1302778f44","observation_id":"3dd529ba-2ded-4228-b98c-d4a75e503ce7","resolution":{"observed_at":"2026-08-02T01:12:23.830265Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-03T12:01:13.263106Z","title":"2026 , publisher =","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.29190","last_updated":"2026-07-31T09:11:56Z","snapshot_observed_at":"2026-08-16T15:41:59.441693Z","submitted_at":"2026-07-31T09:11:56Z","title":"CAGE: Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-03T12:01:13.263106Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2607.29190"},"observation_digest":"sha256:4e21a70a5ca149c044aececa648a6725efb23d11afad713362188738f36beca1","observation_id":"7bc600cf-6912-4448-b7f8-232140c568e0","resolution":{"observed_at":"2026-08-03T12:01:13.263106Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-12T00:47:18.092284Z","title":"MCPTox : A benchmark for tool poisoning attack on real-world MCP servers","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.07952","last_updated":"2026-08-08T06:31:00Z","snapshot_observed_at":"2026-08-19T00:28:21.247907Z","submitted_at":"2026-08-08T06:31:00Z","title":"Persistent Semantic Entities in Tool-Augmented LLM Systems","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-12T00:47:18.092284Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2608.07952"},"observation_digest":"sha256:2a5b13d0549bc81b1908d84b5d160b6f3dff80da7be76770a95c71ce72efeaba","observation_id":"c6000436-ab45-4b5b-9128-e2de2cc16494","resolution":{"observed_at":"2026-08-12T00:47:18.092284Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-15T19:23:24.332483Z","title":"MCP- Tox: A benchmark for tool poisoning attack on real-world MCP servers","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-18T00:17:46.341587Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.332483Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:ccfa5d9d0ff2c37de3a6f1485513807827d459be59fd765860eea952d2b95629","observation_id":"3130b42d-3d50-4847-af82-fc87021e75b9","resolution":{"observed_at":"2026-08-15T19:23:24.332483Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2508.14925/citation-record","integrity":"/paper/2508.14925/integrity","json":"/paper/2508.14925/citation-record.json","paper":"/paper/2508.14925"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T18:59:53.055489Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-05T18:59:53.055489Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2508.14925"},"observation_digest":"sha256:b150e23243684edcaae1f15bd5bf51cd8c5c78f2e4eca3195fa18d689606113b","observation_id":"74f68912-7c38-4f8f-9b1d-db5eb8c2db34","resolution":{"observed_at":"2026-08-05T18:59:53.055489Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers"},"reference_resolution":{"displayed":1,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":1,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":1},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"thesis":"As of 19 August 2026, this Paper Citation Record lists 1 of 1 outbound references and 33 inbound Pith citation observations for arXiv:2508.14925."}