Paper Citation Record · LEDGER

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

As of 21 August 2026, this Paper Citation Record lists 22 of 22 outbound references and 7 inbound Pith citation observations for arXiv:2509.10540.

A citation records a reference. It does not transfer a finding from one paper to another.

pith.paper-citation-record.v1
2509.10540 v1

Coverage vector

measured 22 of 22 reference resolution

Typed states for the displayed outbound observations.

Source: paper_references, paper_reference_links, observed 2026-08-15T16:24:10.748194Z

measured 29 of 29 standing notices

One-hop event checks from named stored sources.

Source: scholarly_work_events, retraction_status_cache, observed 2026-08-20T06:33:59.587034+00:00

measured 7 of 7 inbound itemization

Pith citing papers itemized under the disclosed page cap.

Source: paper_references, paper_reference_links, observed 2026-08-02T05:58:01.260673Z

measured 0 of 1 external citation measurements

A source-named dated measurement, never combined with another source.

Source: arxiv_reference, observed 2026-07-05T07:40:47.616845Z

Reference resolution

22 of 22 outbound references displayed

verified exact0
verified fuzzy0
unresolved22
parse uncertain0
malformed identifier0
metadata mismatch0

External citation measurements

No source-named external measurement is stored.

Outbound references

Observation 5c885a38-10d9-4a3d-a711-20231b35541c · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 1

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.969346Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation ce73e253-45e3-4089-9ec1-0bfa73eaf17a · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 2

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.959957Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation a3976f18-d369-4280-a352-51e960b89c92 · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 3

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.950739Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 0a124ab0-16a6-41f5-8038-26de89b3cbf8 · outbound

This paper cites Retrieval-Augmented Generation for Large Language Models: A Survey.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Retrieval-Augmented Generation for Large Language Models: A Survey

Reference 4

Resolution: unresolved; no resolver link, observed 2026-08-15T16:24:10.685949Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation b1e35195-d99c-41b9-9099-d529b95e34aa · outbound

This paper cites Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection

Reference 5

Resolution: unresolved; no resolver link, observed 2026-08-15T16:24:10.689830Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 636ee463-92ab-44cc-ace7-9ba3f456a4cb · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 6

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.940804Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 426934eb-129c-43b4-be4d-a7d3a61eb55d · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 7

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.931812Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 84ab690a-6649-494d-b9dc-989f560e1ed6 · outbound

This paper cites Demystifying RCE Vulnerabilities in LLM-Integrated Apps.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Demystifying RCE Vulnerabilities in LLM-Integrated Apps

Reference 8

Resolution: unresolved; no resolver link, observed 2026-08-15T16:24:10.701391Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 7e326775-99c0-4c53-9662-7f0d3fa53d0e · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 9

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.922240Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation c4a669ba-c2c2-42f9-9ffd-7575d240f7ec · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 10

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.912080Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 57eb8e35-500d-44e2-95d5-99c66cdbc561 · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 11

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.901212Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 9aa310ea-4e39-4d33-97d1-3711fecea852 · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 12

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.891863Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 63f04b8e-d8ef-4b1c-83bd-750839415f2b · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 13

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.882533Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation f98a4acd-1243-4f95-912a-12fd5374ed2c · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 14

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.872773Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 91eb3464-cafc-473d-8e83-1a631401644b · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 15

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.862750Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 2d72034b-faee-467b-aee6-770efe41f2e8 · outbound

This paper cites Ignore Previous Prompt: Attack Techniques For Language Models.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Ignore Previous Prompt: Attack Techniques For Language Models

Reference 16

Resolution: unresolved; no resolver link, observed 2026-08-15T16:24:10.728527Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 3b3867d6-5673-42e7-a83e-a554e5cc2255 · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 17

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.853011Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation f297e76c-0bb4-4dbf-935a-5f8c5a23181b · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 18

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.843913Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 32fd2328-0a4d-4623-a6e1-c50a0b215d05 · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 19

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.833934Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 2ea223b8-c3c4-4bc1-a71a-64c96f87a859 · outbound

This paper cites an unresolved cited work.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System Unresolved cited work

Reference 20

Resolution: unresolved; raw_fallback, observed 2026-08-15T16:24:10.823673Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 393b7542-0c94-45e4-9fa1-5f168877724c · outbound

This paper cites , " * write output.state after.block = add.period write newline.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System , " * write output.state after.block = add.period write newline

Reference 21

Resolution: unresolved; no resolver link, observed 2026-08-15T16:24:10.744447Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation ef77bbcd-4b92-4564-8dd7-0ca58eba198f · outbound

This paper cites write newline.

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System write newline

Reference 22

Resolution: unresolved; no resolver link, observed 2026-08-15T16:24:10.748194Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Pith citing papers

Observation 275298e0-c703-4a89-8d2f-85421dbae657 · inbound

When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI cites this paper.

When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

Reference 7

Resolution: verified exact; arxiv_id, observed 2026-05-12T10:46:31.578307Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation b6724033-57f4-47bf-9032-5e5d939d2b4f · inbound

When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI cites this paper.

When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

Reference 7

Resolution: verified exact; arxiv_id, observed 2026-05-09T06:55:44.484453Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 70b68a3b-0df5-460f-a703-5543dfa4674d · inbound

IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection cites this paper.

IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

Reference 2

Resolution: verified exact; arxiv_id, observed 2026-05-13T05:47:21.306811Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 51f16092-5ff6-490d-bb3f-6e56f252d14c · inbound

An Empirical Study of Privacy Leakage Chains via Prompt Injection in Black-Box Chatbot Environments cites this paper.

An Empirical Study of Privacy Leakage Chains via Prompt Injection in Black-Box Chatbot Environments EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

Reference 9

Resolution: verified exact; arxiv_id, observed 2026-05-20T09:58:10.909078Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 3f061f6e-ef7f-4ca4-a908-6c4b723ab5d0 · inbound

Agentic Literacy Debt: A Structural Problem the AI Literacy Field Has Not Yet Named cites this paper.

Agentic Literacy Debt: A Structural Problem the AI Literacy Field Has Not Yet Named EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

Reference 5

Resolution: metadata mismatch; arxiv_id, observed 2026-07-05T07:40:47.618596Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

Observation 9f25e6f0-4063-4064-a76d-0b1a2384dcd0 · inbound

Beyond Object Validation: Relational Conformance in Multi-Artifact Agent Releases cites this paper.

Beyond Object Validation: Relational Conformance in Multi-Artifact Agent Releases EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

Reference 43

Resolution: unresolved; no resolver link, observed 2026-08-02T05:58:01.260673Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 3bc24c1e-11f6-4de4-b241-7937b170c3f7 · inbound

The Chronos Vulnerability: A Taxonomy of Temporal Persistence and Memory-Based Deception in Agentic AI cites this paper.

The Chronos Vulnerability: A Taxonomy of Temporal Persistence and Memory-Based Deception in Agentic AI EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

Reference 12

Resolution: unresolved; no resolver link, observed 2026-08-01T15:05:19.509390Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.