{"as_of":"2026-08-13T20:34:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:091019bfba24f264479a8f6e41a2d4d4c30981d37c870c82fdc5d297f4a11575","coverage":[{"denominator":0,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":10,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":10,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-13T06:32:02.005865+00:00","state":"measured"},{"denominator":10,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":10,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-11T02:41:24.813416Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-07-11T02:47:50.254511Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2603.22928","last_updated":"2026-08-11T08:45:07Z","snapshot_observed_at":"2026-08-13T19:42:34.304753Z","submitted_at":"2026-03-24T08:21:51Z","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","version":2},"cited_work":{"arxiv_id":"2603.22928","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2603.22928","snapshot_observed_at":"2026-08-12T02:24:10.274858Z","title":"Sok: The attack surface of agentic ai–tools, and autonomy","venue":null,"work_id":"c185362d-a226-40fa-a8d2-fc48331ef5bf","year":2026},"citing_paper":{"arxiv_id":"2604.02767","last_updated":"2026-04-03T06:25:18Z","snapshot_observed_at":"2026-08-02T15:11:57.622955Z","submitted_at":"2026-04-03T06:25:18Z","title":"SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-13T20:14:56.132341Z"},"links":{"cited_paper":"/paper/2603.22928","citing_paper":"/paper/2604.02767"},"observation_digest":"sha256:8e8ed5e2b6c812de4448297ef67c5b068c6f0693182bb10b04bdf6fa02ef7beb","observation_id":"d8c7c313-37c3-4a08-900c-4c6e96e30665","resolution":{"observed_at":"2026-08-12T02:24:10.274858Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.22928","last_updated":"2026-08-11T08:45:07Z","snapshot_observed_at":"2026-08-13T19:42:34.304753Z","submitted_at":"2026-03-24T08:21:51Z","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","version":2},"cited_work":{"arxiv_id":"2603.22928","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2603.22928","snapshot_observed_at":"2026-08-12T02:24:10.274858Z","title":"Sok: The attack surface of agentic ai–tools, and autonomy","venue":null,"work_id":"c185362d-a226-40fa-a8d2-fc48331ef5bf","year":2026},"citing_paper":{"arxiv_id":"2604.05969","last_updated":"2026-04-07T15:02:47Z","snapshot_observed_at":"2026-08-13T07:58:46.587028Z","submitted_at":"2026-04-07T15:02:47Z","title":"A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-10T19:39:27.982512Z"},"links":{"cited_paper":"/paper/2603.22928","citing_paper":"/paper/2604.05969"},"observation_digest":"sha256:ab56eb684d683c66bd1a88157b5f012438368aff412252ff1e73c65ca3315ea5","observation_id":"b0cd2e70-8c58-432c-a4f2-2b8a17f50aa2","resolution":{"observed_at":"2026-08-12T02:24:10.274858Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.22928","last_updated":"2026-08-11T08:45:07Z","snapshot_observed_at":"2026-08-13T19:42:34.304753Z","submitted_at":"2026-03-24T08:21:51Z","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","version":2},"cited_work":{"arxiv_id":"2603.22928","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2603.22928","snapshot_observed_at":"2026-08-12T02:24:10.274858Z","title":"Sok: The attack surface of agentic ai–tools, and autonomy","venue":null,"work_id":"c185362d-a226-40fa-a8d2-fc48331ef5bf","year":2026},"citing_paper":{"arxiv_id":"2605.10779","last_updated":"2026-05-11T16:14:04Z","snapshot_observed_at":"2026-08-11T10:07:47.669569Z","submitted_at":"2026-05-11T16:14:04Z","title":"LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-12T04:08:05.893904Z"},"links":{"cited_paper":"/paper/2603.22928","citing_paper":"/paper/2605.10779"},"observation_digest":"sha256:a78ad677e69b1c36772c86d5c7e23886eac236825668a131f36cc4cf875f883d","observation_id":"287fef8e-2eef-47bf-8305-0f94ee4cfeb9","resolution":{"observed_at":"2026-08-12T02:24:10.274858Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.22928","last_updated":"2026-08-11T08:45:07Z","snapshot_observed_at":"2026-08-13T19:42:34.304753Z","submitted_at":"2026-03-24T08:21:51Z","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","version":2},"cited_work":{"arxiv_id":"2603.22928","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2603.22928","snapshot_observed_at":"2026-08-12T02:24:10.274858Z","title":"Sok: The attack surface of agentic ai–tools, and autonomy","venue":null,"work_id":"c185362d-a226-40fa-a8d2-fc48331ef5bf","year":2026},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2603.22928","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:0e8aa2a6c81d77c376832bcb67ebeb130eca9ee5fcf27424a0057bf9ac5ab2d1","observation_id":"3ca4c3cd-6b4d-45fd-94ef-b44b234b9aba","resolution":{"observed_at":"2026-08-12T02:24:10.274858Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.22928","last_updated":"2026-08-11T08:45:07Z","snapshot_observed_at":"2026-08-13T19:42:34.304753Z","submitted_at":"2026-03-24T08:21:51Z","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","version":2},"cited_work":{"arxiv_id":"2603.22928","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2603.22928","snapshot_observed_at":"2026-08-12T02:24:10.274858Z","title":"Sok: The attack surface of agentic ai–tools, and autonomy","venue":null,"work_id":"c185362d-a226-40fa-a8d2-fc48331ef5bf","year":2026},"citing_paper":{"arxiv_id":"2606.02668","last_updated":"2026-06-01T11:08:17Z","snapshot_observed_at":"2026-07-06T23:43:02.654629Z","submitted_at":"2026-06-01T11:08:17Z","title":"What You Approve Is What Executes: Consent Integrity for Black-Box LLM Agents","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-06-28T14:12:38.815852Z"},"links":{"cited_paper":"/paper/2603.22928","citing_paper":"/paper/2606.02668"},"observation_digest":"sha256:f5afa8ad76790cf43993f6224e974d9b2ce716d65c04085f93088fd735743332","observation_id":"6ba71fd9-3176-440f-920a-78c49de5037b","resolution":{"observed_at":"2026-08-12T02:24:10.274858Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.22928","last_updated":"2026-08-11T08:45:07Z","snapshot_observed_at":"2026-08-13T19:42:34.304753Z","submitted_at":"2026-03-24T08:21:51Z","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","version":2},"cited_work":{"arxiv_id":"2603.22928","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2603.22928","snapshot_observed_at":"2026-08-12T02:24:10.274858Z","title":"Sok: The attack surface of agentic ai–tools, and autonomy","venue":null,"work_id":"c185362d-a226-40fa-a8d2-fc48331ef5bf","year":2026},"citing_paper":{"arxiv_id":"2606.12320","last_updated":"2026-06-10T16:54:47Z","snapshot_observed_at":"2026-08-12T10:33:20.756748Z","submitted_at":"2026-06-10T16:54:47Z","title":"A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-06-27T10:09:35.461423Z"},"links":{"cited_paper":"/paper/2603.22928","citing_paper":"/paper/2606.12320"},"observation_digest":"sha256:ab5362f70e05aec19fa3cfb01d2dbc5980f3100759a80fef4dfb45c5388d6bc8","observation_id":"46d78f36-85f8-460d-960a-beefad30dab0","resolution":{"observed_at":"2026-08-12T02:24:10.274858Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.22928","last_updated":"2026-08-11T08:45:07Z","snapshot_observed_at":"2026-08-13T19:42:34.304753Z","submitted_at":"2026-03-24T08:21:51Z","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","version":2},"cited_work":{"arxiv_id":"2603.22928","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2603.22928","snapshot_observed_at":"2026-08-12T02:24:10.274858Z","title":"Sok: The attack surface of agentic ai–tools, and autonomy","venue":null,"work_id":"c185362d-a226-40fa-a8d2-fc48331ef5bf","year":2026},"citing_paper":{"arxiv_id":"2606.23075","last_updated":"2026-06-22T09:23:50Z","snapshot_observed_at":"2026-08-02T06:16:18.387353Z","submitted_at":"2026-06-22T09:23:50Z","title":"Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studies","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-06-26T08:11:30.091859Z"},"links":{"cited_paper":"/paper/2603.22928","citing_paper":"/paper/2606.23075"},"observation_digest":"sha256:205a2b34bb735072f3332d076e3d77a415cd75f520aea9b7d4e3dbc14f066612","observation_id":"5dacf644-5d70-4bf7-b504-9cceeaa683a1","resolution":{"observed_at":"2026-08-12T02:24:10.274858Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.22928","last_updated":"2026-08-11T08:45:07Z","snapshot_observed_at":"2026-08-13T19:42:34.304753Z","submitted_at":"2026-03-24T08:21:51Z","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","version":2},"cited_work":{"arxiv_id":"2603.22928","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2603.22928","snapshot_observed_at":"2026-08-12T02:24:10.274858Z","title":"Sok: The attack surface of agentic ai–tools, and autonomy","venue":null,"work_id":"c185362d-a226-40fa-a8d2-fc48331ef5bf","year":2026},"citing_paper":{"arxiv_id":"2606.26479","last_updated":"2026-06-25T00:35:23Z","snapshot_observed_at":"2026-07-07T00:00:46.505337Z","submitted_at":"2026-06-25T00:35:23Z","title":"Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-06-26T04:58:59.046289Z"},"links":{"cited_paper":"/paper/2603.22928","citing_paper":"/paper/2606.26479"},"observation_digest":"sha256:2ccee99e080bfd3e70c10ebc4b531924d7929b889c06c25bc23dc4bb05fd32cd","observation_id":"c61486d8-28f7-4389-bc83-76da6b4aaa84","resolution":{"observed_at":"2026-08-12T02:24:10.274858Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.22928","last_updated":"2026-08-11T08:45:07Z","snapshot_observed_at":"2026-08-13T19:42:34.304753Z","submitted_at":"2026-03-24T08:21:51Z","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","version":2},"cited_work":{"arxiv_id":"2603.22928","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2603.22928","snapshot_observed_at":"2026-08-12T02:24:10.274858Z","title":"Sok: The attack surface of agentic ai–tools, and autonomy","venue":null,"work_id":"c185362d-a226-40fa-a8d2-fc48331ef5bf","year":2026},"citing_paper":{"arxiv_id":"2606.31639","last_updated":"2026-06-30T13:21:43Z","snapshot_observed_at":"2026-08-13T03:20:31.232060Z","submitted_at":"2026-06-30T13:21:43Z","title":"A Lifecycle and Application-Stack Survey of Large Language Model Vulnerabilities: Attacks, Risks, Defenses, and Open Problems","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-07-01T04:44:23.543728Z"},"links":{"cited_paper":"/paper/2603.22928","citing_paper":"/paper/2606.31639"},"observation_digest":"sha256:38dec63118604f342f535b1e8ac9ca8a4390b7ff7d2f01c7c4c7db1341d6029b","observation_id":"1cbc9a31-29ac-462c-ba18-8d4fd37b8fc8","resolution":{"observed_at":"2026-08-12T02:24:10.274858Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.22928","last_updated":"2026-08-11T08:45:07Z","snapshot_observed_at":"2026-08-13T19:42:34.304753Z","submitted_at":"2026-03-24T08:21:51Z","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","version":2},"cited_work":{"arxiv_id":"2603.22928","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2603.22928","snapshot_observed_at":"2026-08-12T02:24:10.274858Z","title":"Sok: The attack surface of agentic ai–tools, and autonomy","venue":null,"work_id":"c185362d-a226-40fa-a8d2-fc48331ef5bf","year":2026},"citing_paper":{"arxiv_id":"2607.05743","last_updated":"2026-07-07T01:56:18Z","snapshot_observed_at":"2026-08-06T20:18:50.545716Z","submitted_at":"2026-07-07T01:56:18Z","title":"The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-07-11T02:41:24.813416Z"},"links":{"cited_paper":"/paper/2603.22928","citing_paper":"/paper/2607.05743"},"observation_digest":"sha256:64001b1cb4eb23138135f47c0d68dff27ceda61cbef595359c79def2699f0569","observation_id":"a1ba4bd8-ba67-4e25-817a-e8c036be8f5f","resolution":{"observed_at":"2026-08-12T02:24:10.274858Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2603.22928/citation-record","integrity":"/paper/2603.22928/integrity","json":"/paper/2603.22928/citation-record.json","paper":"/paper/2603.22928"},"outbound":[],"paper":{"arxiv_id":"2603.22928","last_updated":"2026-08-11T08:45:07Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-13T19:42:34.304753Z","submitted_at":"2026-03-24T08:21:51Z","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy"},"reference_resolution":{"displayed":0,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":0},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"thesis":"As of 13 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 10 inbound Pith citation observations for arXiv:2603.22928."}