{"as_of":"2026-08-06T19:28:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:2421f36c179197efd21c96dd2ab31323e04acdd321b60fd4a24aa8ec588e2135","coverage":[{"denominator":22,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":22,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-10T19:20:52.845052Z","state":"measured"},{"denominator":34,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":34,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-06T06:34:29.942622+00:00","state":"measured"},{"denominator":12,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":12,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-10T08:08:21.077290Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"pith","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"pith"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:7c8a68c77a704dabe4476dd36e757e5e2c7a0eaa904c9339abee8dc7f23902e4","observation_id":"857b32e5-5f7b-45c6-a219-0997fc26a1a6","resolution":{"observed_at":"2026-05-11T20:26:11.296295Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2605.06731","last_updated":"2026-05-07T12:25:16Z","snapshot_observed_at":"2026-08-05T23:33:08.523736Z","submitted_at":"2026-05-07T12:25:16Z","title":"When Routine Chats Turn Toxic: Unintended Long-Term State Poisoning in Personalized Agents","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-11T00:51:06.697737Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2605.06731"},"observation_digest":"sha256:105fa91c66068b0a6f362b5ca85ccc6998f9c9ce0dcec620912166f81e269153","observation_id":"9e3c66f2-e293-4a8f-b10f-94e15c1f2adf","resolution":{"observed_at":"2026-05-11T05:10:54.266252Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2605.06812","last_updated":"2026-05-07T18:14:29Z","snapshot_observed_at":"2026-07-06T23:19:15.382283Z","submitted_at":"2026-05-07T18:14:29Z","title":"Towards Security-Auditable LLM Agents: A Unified Graph Representation","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-05-11T01:23:23.514576Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2605.06812"},"observation_digest":"sha256:f47df7d19e7c354bef02163ef0f971c6ed6a22dcbb528263b7c64f15db10537d","observation_id":"df7f8569-98de-49d4-9c64-f1644579edf0","resolution":{"observed_at":"2026-05-11T04:25:58.519715Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2605.07110","last_updated":"2026-05-08T01:38:46Z","snapshot_observed_at":"2026-07-06T23:19:30.387067Z","submitted_at":"2026-05-08T01:38:46Z","title":"Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliability","version":1},"reference_index":129,"source":"pdf_text","source_observed_at":"2026-05-11T01:15:19.239355Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2605.07110"},"observation_digest":"sha256:2ea59a4a971a3a28735c1a670f806581070dfca5b0cd7691ca18a1bf20c860d9","observation_id":"f77f0fea-168a-4bb1-9f72-fe82c0ec5b0e","resolution":{"observed_at":"2026-05-11T04:35:56.724642Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2605.13940","last_updated":"2026-05-13T17:04:17Z","snapshot_observed_at":"2026-07-06T23:25:25.361350Z","submitted_at":"2026-05-13T17:04:17Z","title":"AgentTrap: Measuring Runtime Trust Failures in Third-Party Agent Skills","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-15T05:40:52.709457Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2605.13940"},"observation_digest":"sha256:175ed53b68f3d0a819801e386f6bee251be3126dd98a44929bf8d508e1ed30cd","observation_id":"68d8b81f-ef5f-4d8e-a9e1-f04011d7b669","resolution":{"observed_at":"2026-05-15T05:45:06.755603Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2605.25435","last_updated":"2026-05-25T05:25:39Z","snapshot_observed_at":"2026-07-06T23:35:21.734804Z","submitted_at":"2026-05-25T05:25:39Z","title":"Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-06-29T22:00:03.325985Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2605.25435"},"observation_digest":"sha256:4f25ee3cea91a983a6fdcdf2193104947ba988a4a862f9c29d08b376b7db9355","observation_id":"022b9e05-56d2-45dd-aacc-b6a02dc219a2","resolution":{"observed_at":"2026-06-29T22:04:00.332138Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2605.30693","last_updated":"2026-05-29T00:36:48Z","snapshot_observed_at":"2026-08-02T21:44:58.322249Z","submitted_at":"2026-05-29T00:36:48Z","title":"Triaging Threats to Specialized Guardrails","version":1},"reference_index":48,"source":"arxiv_source","source_observed_at":"2026-06-28T22:27:44.703466Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2605.30693"},"observation_digest":"sha256:30d680be854cd655a1bf5cf0628013bb4335b49a062e3460d5591813d56fa666","observation_id":"31dc9603-8746-420b-aa9a-2f94b7007ae1","resolution":{"observed_at":"2026-06-28T22:32:44.297971Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2606.02041","last_updated":"2026-06-01T10:30:08Z","snapshot_observed_at":"2026-08-06T02:57:08.156185Z","submitted_at":"2026-06-01T10:30:08Z","title":"SentGuard: Sentence-Level Streaming Guardrails for Large Language Models","version":1},"reference_index":49,"source":"arxiv_source","source_observed_at":"2026-06-28T14:51:17.667213Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2606.02041"},"observation_digest":"sha256:19ae5e33349e766ca81f040797d8439e6d81bf7525d266b6b0590e50a5bfecab","observation_id":"d60e1be1-0e7b-40bc-b673-f799fa033439","resolution":{"observed_at":"2026-07-01T22:56:20.687244Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2606.03889","last_updated":"2026-06-05T09:38:21Z","snapshot_observed_at":"2026-08-02T13:33:31.496138Z","submitted_at":"2026-06-02T16:51:24Z","title":"RealClawBench: Live OpenClaw Benchmarks from Real Developer-Agent Sessions","version":2},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-06-28T09:56:36.860369Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2606.03889"},"observation_digest":"sha256:ba7ebbc9bdc439024c50df8fbdef5847a1d4fe6d73bfac914c41ab6dc6a69e12","observation_id":"97b307b2-1370-423b-8aba-d86c2f2bcc1c","resolution":{"observed_at":"2026-07-02T03:36:29.204275Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2606.11007","last_updated":"2026-06-09T15:41:48Z","snapshot_observed_at":"2026-07-06T23:50:06.645076Z","submitted_at":"2026-06-09T15:41:48Z","title":"Understanding and mitigating the risks of OpenClaw for non-technical users: A practical guide with Skill","version":1},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-06-27T12:39:26.314984Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2606.11007"},"observation_digest":"sha256:f6e124b51ca075421f0bf0208d0d8944f731f0543435f55ba5d8a18269728f7f","observation_id":"bd65ac44-df28-43c6-941b-5a97c8e8f75e","resolution":{"observed_at":"2026-07-03T06:27:42.546356Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2606.11671","last_updated":"2026-06-10T05:29:34Z","snapshot_observed_at":"2026-08-01T07:30:24.882086Z","submitted_at":"2026-06-10T05:29:34Z","title":"Runtime Skill Audit: Targeted Runtime Probing for Agent Skill Security","version":1},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-06-27T09:28:48.695776Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2606.11671"},"observation_digest":"sha256:57651bbb5795b6604ef1be84bb73f1fb53e6a18a6e77824f50e6665b5624c51c","observation_id":"3796e0f5-18e4-4029-bbd7-b552b6da6ff4","resolution":{"observed_at":"2026-06-27T09:30:46.567722Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:4856ba097c80ef5c389956ddd05800ed16367e34b043071ee1643092fdbf9796","observation_id":"15392d6f-5a54-41cf-8448-3330a8117018","resolution":{"observed_at":"2026-07-10T08:16:58.839855Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2604.04759/citation-record","integrity":"/paper/2604.04759/integrity","json":"/paper/2604.04759/citation-record.json","paper":"/paper/2604.04759"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2410.09024","last_updated":"2025-04-18T14:30:31Z","snapshot_observed_at":"2026-08-02T12:38:54.249632Z","submitted_at":"2024-10-11T17:39:22Z","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","version":3},"cited_work":{"arxiv_id":"2410.09024","doi":"10.48550/arxiv.2410.09024","metadata_source":"pith","pith_arxiv_id":"2410.09024","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","venue":"cs.LG","work_id":"788aad10-421f-48d7-886c-792665914606","year":2024},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2410.09024","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:9017ce27a3f35ef977603cfa9e34005e3c71d4638802710435e5ae279eb591df","observation_id":"c15afb40-110d-44c0-ba64-e3e05a009e5d","resolution":{"observed_at":"2026-05-14T01:35:51.514012Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.12784","last_updated":"2024-07-17T17:59:47Z","snapshot_observed_at":"2026-07-06T18:47:56.109836Z","submitted_at":"2024-07-17T17:59:47Z","title":"AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases","version":1},"cited_work":{"arxiv_id":"2407.12784","doi":"10.48550/arxiv.2407.12784","metadata_source":"pith","pith_arxiv_id":"2407.12784","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases","venue":"cs.LG","work_id":"fd576f32-99d7-40a6-866a-ad86ad47565d","year":2024},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2407.12784","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:92a5dfeeec00399e354bcf27bc4065a603827df330928c326222e0b3f0a1e2d2","observation_id":"001b5b4e-cb7a-4a58-90cc-94b4585e9216","resolution":{"observed_at":"2026-05-10T23:05:49.143007Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:c30da1381ebfc9edcc09014f87b2f6bbae787d18e5be9a9118261b92e281a7ce","observation_id":"e84540e6-9de9-46d1-90cb-392d7ea970ad","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2503.03704","doi":"10.48550/arxiv.2503.03704","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Yann Dubois, Balázs Galambosi, Percy Liang, and Tat- sunori B Hashimoto","venue":"arXiv (Cornell University)","work_id":"cc008b41-0943-47c8-81e7-bafb5beac6ce","year":2025},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:3d1f07aa4d6627baa30381a83a1c5351cfe86bc58c4b6c6899e4bc11b4c533fe","observation_id":"f8a1f2e7-a420-401e-adcb-0613e77d621e","resolution":{"observed_at":"2026-05-10T23:05:49.075039Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2302.12173","last_updated":"2023-05-05T14:26:17Z","snapshot_observed_at":"2026-07-06T14:55:08.682906Z","submitted_at":"2023-02-23T17:14:38Z","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","version":2},"cited_work":{"arxiv_id":"2302.12173","doi":"10.1109/sp61157.2025.00250","metadata_source":"pith","pith_arxiv_id":"2302.12173","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","venue":"cs.CR","work_id":"7a8cfce1-ada7-4a7a-8516-6f16b1bd077b","year":2023},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2302.12173","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:6b683bdb64978aa22dcdc09d6c17fcb7d35743ea6c1e8fdb29522ae1882d28b1","observation_id":"164f1ff0-6ba0-4b39-a78d-ef2627e73184","resolution":{"observed_at":"2026-05-11T17:17:55.937474Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.04860","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T12:29:52.436037Z","title":"Siwei Han, Kaiwen Xiong, Jiaqi Liu, Xinyu Ye, Yaofeng Su, Wenbo Duan, Xinyuan Liu, Cihang Xie, Mohit Bansal, Mingyu Ding, et al","venue":null,"work_id":"74fcf4c0-c64f-4e4c-ab45-f420ba5d38f0","year":2025},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:cf52ffe26e6fc2a9357dbd3b183e303c777144c4bf379e904fdf4cfd98bd3bbc","observation_id":"76ab5808-34f9-436d-93f1-8deeb64949af","resolution":{"observed_at":"2026-05-10T23:05:49.053846Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2602.14211","last_updated":"2026-06-16T17:33:00Z","snapshot_observed_at":"2026-08-02T23:20:40.869423Z","submitted_at":"2026-02-15T16:09:48Z","title":"SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents","version":3},"cited_work":{"arxiv_id":"2602.14211","doi":null,"metadata_source":"pith","pith_arxiv_id":"2602.14211","snapshot_observed_at":"2026-07-04T19:30:07.985851Z","title":"Skillject: Automating stealthy skill-based prompt injection for coding agents with trace-driven closed-loop refinement.arXiv preprint","venue":"cs.CR","work_id":"b53d64dd-e5ba-4b7d-b97a-50f18ac7efd7","year":2026},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2602.14211","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:8c05b0bb090f3e08bc3dd866a71db20629fd24e97f318370465966d80d67296e","observation_id":"93dd8247-19af-4461-8fa8-b3e580e54265","resolution":{"observed_at":"2026-05-20T00:03:05.796937Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.13886","last_updated":"2024-10-21T18:06:58Z","snapshot_observed_at":"2026-07-06T19:35:30.732080Z","submitted_at":"2024-10-11T06:54:12Z","title":"Refusal-Trained LLMs Are Easily Jailbroken As Browser Agents","version":2},"cited_work":{"arxiv_id":"2410.13886","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2410.13886","snapshot_observed_at":"2026-07-02T08:06:48.241191Z","title":"Thomas Kuntz, Agatha Duzan, Hao Zhao, Francesco Croce, Zico Kolter, Nicolas Flammarion, and Maksym Andriushchenko","venue":null,"work_id":"cb52e713-1b92-4742-b861-b66f06159bcc","year":2025},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2410.13886","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:9ff9eab708294f195c9604aa3da409fcc95b09fa45c97a07e9c3efb9b8bc32ed","observation_id":"38f9d78d-96bd-4d95-a5fc-19938868ad31","resolution":{"observed_at":"2026-05-10T23:05:49.008995Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2601.10338","last_updated":"2026-01-15T12:31:52Z","snapshot_observed_at":"2026-07-06T22:41:48.115083Z","submitted_at":"2026-01-15T12:31:52Z","title":"Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale","version":1},"cited_work":{"arxiv_id":"2601.10338","doi":"10.48550/arxiv.2601.10338","metadata_source":"pith","pith_arxiv_id":"2601.10338","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale","venue":"cs.CR","work_id":"0780d782-7977-4d63-a1f2-3ae587a49c98","year":2026},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2601.10338","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:ea4832841b009a1d3b1f7cecd58b1874d417cf97758adf79b7edfaeb4a61dd48","observation_id":"9759749a-e360-4fb3-b69d-16513a2b187c","resolution":{"observed_at":"2026-05-14T23:41:24.390564Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2509.22040","last_updated":"2026-04-28T01:43:32Z","snapshot_observed_at":"2026-08-02T08:19:00.747753Z","submitted_at":"2025-09-26T08:20:54Z","title":"\"Your AI, My Shell\": Demystifying Prompt Injection Attacks on Agentic AI Coding Editors","version":2},"cited_work":{"arxiv_id":"2509.22040","doi":"10.48550/arxiv.2509.22040","metadata_source":"pith","pith_arxiv_id":"2509.22040","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"\"Your AI, My Shell\": Demystifying Prompt Injection Attacks on Agentic AI Coding Editors","venue":"cs.CR","work_id":"c1c47ea1-cca6-4aff-ba0b-8dfc868060bd","year":2025},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2509.22040","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:fa398d217c55020532241b80491d3825a51ef33a975c65334d49bd7681d4e2bc","observation_id":"19493644-8c33-47ad-b999-536a5f89d53a","resolution":{"observed_at":"2026-05-10T23:05:49.033410Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08560","last_updated":"2024-02-12T18:59:46Z","snapshot_observed_at":"2026-08-03T06:31:15.541423Z","submitted_at":"2023-10-12T17:51:32Z","title":"MemGPT: Towards LLMs as Operating Systems","version":2},"cited_work":{"arxiv_id":"2310.08560","doi":"10.48550/arxiv.2310.08560","metadata_source":"pith","pith_arxiv_id":"2310.08560","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"MemGPT: Towards LLMs as Operating Systems","venue":"cs.AI","work_id":"2698f5ad-c84c-40ca-b839-0912dae10ba2","year":2023},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2310.08560","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:b1142ce949bddb5ec7d8747da4f9e8ce7750827ec436d3786c9c3f3a3c244598","observation_id":"2caec978-f9ca-4962-bf97-2c81a819149a","resolution":{"observed_at":"2026-05-10T23:05:49.112231Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-07-13T15:49:35.543803+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-13T15:49:35.543803+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.15817","last_updated":"2024-05-17T17:17:45Z","snapshot_observed_at":"2026-07-06T16:24:30.545494Z","submitted_at":"2023-09-25T17:08:02Z","title":"Identifying the Risks of LM Agents with an LM-Emulated Sandbox","version":2},"cited_work":{"arxiv_id":"2309.15817","doi":"10.48550/arxiv.2309.15817","metadata_source":"pith","pith_arxiv_id":"2309.15817","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Identifying the Risks of LM Agents with an LM-Emulated Sandbox","venue":"cs.AI","work_id":"3d4c3b66-d749-4939-b1bc-62b10b2ebbb6","year":2023},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2309.15817","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:796ad7574b6d303545c41911d325468f068564aaa30a81ea609a5e49ab32db73","observation_id":"0aa92f5b-73d8-4cbd-b609-3c4dd1d86405","resolution":{"observed_at":"2026-05-12T20:45:24.770470Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.01833","last_updated":"2025-02-26T13:41:41Z","snapshot_observed_at":"2026-08-03T07:26:39.431128Z","submitted_at":"2024-04-02T10:45:49Z","title":"Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack","version":3},"cited_work":{"arxiv_id":"2404.01833","doi":"10.48550/arxiv.2404.01833","metadata_source":"pith","pith_arxiv_id":"2404.01833","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack","venue":"cs.CR","work_id":"f5f042df-896f-4ecb-9b39-a9c500b29669","year":2024},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2404.01833","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:54ae4c133d024cfd697f29dde49be690394877ceaacc2ed298d86fa39e1e9af6","observation_id":"de8577e4-ba35-4a31-8694-ba6429ab313f","resolution":{"observed_at":"2026-05-18T02:12:41.612505Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2509.26354","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"arXiv preprint arXiv:2509.26354 , year=","venue":null,"work_id":"6ab4d1e7-8b71-49fc-beee-0eae3274d4a7","year":2025},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:2354bc2c5dd1470e3555429a8943c3b85e7acbd5b353f0eaf18a7dc837fba61a","observation_id":"b675c814-2f3b-44f0-a389-580a2a9482e0","resolution":{"observed_at":"2026-05-10T23:05:49.121168Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2507.06134","doi":"10.48550/arxiv.2507.06134","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Vijayvargiya, A","venue":"ArXiv.org","work_id":"7315530a-8de5-452c-9c59-6e0cc7436bf1","year":2025},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:a7c37c584c2fb59e95f81620c2ec4cdb85aa605c17a663a64bfa6d538507227e","observation_id":"fcf02fd4-dc69-4ff4-8284-be968e31be2f","resolution":{"observed_at":"2026-05-10T23:05:49.091542Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2305.16291","last_updated":"2023-10-19T16:27:03Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-05-25T17:46:38Z","title":"Voyager: An Open-Ended Embodied Agent with Large Language Models","version":2},"cited_work":{"arxiv_id":"2305.16291","doi":"10.18653/v1/2023.emnlp-main.118","metadata_source":"pith","pith_arxiv_id":"2305.16291","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Voyager: An Open-Ended Embodied Agent with Large Language Models","venue":"cs.AI","work_id":"ffe0d207-86cf-4742-a100-e988ac8b9676","year":2023},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2305.16291","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:895881bcfd80872bc17c87e36a1fbfe3f8b309cb78a2f44bc236f9ad07ef998d","observation_id":"707939fc-a688-48a8-bfea-2a1130d28c31","resolution":{"observed_at":"2026-05-10T23:05:49.012808Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-05T18:59:41.612871Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:e9b9af463312acb3e1e2a6bb371bde18ab6bc6de0555c4c0ef1a4d6f2c923e0e","observation_id":"f07e0b5e-6a0b-4a0f-b2b8-b5390e8e0a91","resolution":{"observed_at":"2026-05-10T23:05:49.116124Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.07864","last_updated":"2023-09-19T08:29:18Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-09-14T17:12:03Z","title":"The Rise and Potential of Large Language Model Based Agents: A Survey","version":3},"cited_work":{"arxiv_id":"2309.07864","doi":"10.1186/s12912-025-04245-9","metadata_source":"pith","pith_arxiv_id":"2309.07864","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"The Rise and Potential of Large Language Model Based Agents: A Survey","venue":"cs.AI","work_id":"985ca219-7e34-4c4f-bdc5-ccd39763ad61","year":2023},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2309.07864","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:84a4306583eeac99117a7a91b2b71d93ecfca249d6f392e1c0b18fb5b42ac16e","observation_id":"afb4621c-02cb-4646-bf0c-d17c103a32a6","resolution":{"observed_at":"2026-05-11T10:48:03.736032Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.15654","doi":"10.48550/arxiv.2602.15654","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Zombie agents: Persistent control of self-evolving llm agents via self-reinforcing injections","venue":"Open MIND","work_id":"f54a401d-0346-4ca5-b2e1-7498a5d77e8c","year":2026},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:0ab10fe7ecb3f7ad8ea785ad80f1318c0a74a789485263f94550e0e71531d761","observation_id":"94cfb36d-2ce3-4251-b003-94e4acdc0c9e","resolution":{"observed_at":"2026-05-10T23:05:49.064345Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02691","last_updated":"2024-08-04T04:52:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-05T06:21:45Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","version":3},"cited_work":{"arxiv_id":"2403.02691","doi":"10.1145/3696410.3714756","metadata_source":"pith","pith_arxiv_id":"2403.02691","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","venue":"cs.CL","work_id":"5cbfcda4-ec26-44e4-be60-e1525956d71d","year":2024},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2403.02691","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:d04b2344e868592a1d9f28c2c742ebf945be48de7e9e185679849eca676cc456","observation_id":"43f11e62-6696-4cc7-a689-61b3f6024e1c","resolution":{"observed_at":"2026-05-13T21:40:06.567267Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.02644","last_updated":"2025-05-30T03:50:33Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-10-03T16:30:47Z","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","version":4},"cited_work":{"arxiv_id":"2410.02644","doi":"10.48550/arxiv.2410.02644","metadata_source":"pith","pith_arxiv_id":"2410.02644","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","venue":"cs.CR","work_id":"15ab4a69-85ab-4295-839d-080a2cd3e7aa","year":2024},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2410.02644","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:617e8395dbc8f19b81b6c7005ac751080bbd7340fb070ac1d94cdad8acb5c7e5","observation_id":"8ce834dd-2314-4dcf-9bef-42884f498a57","resolution":{"observed_at":"2026-05-12T13:36:57.477107Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.07867","last_updated":"2024-08-13T01:55:06Z","snapshot_observed_at":"2026-07-06T17:29:05.185768Z","submitted_at":"2024-02-12T18:28:36Z","title":"PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models","version":3},"cited_work":{"arxiv_id":"2402.07867","doi":"10.48550/arxiv.2402.07867","metadata_source":"arxiv_reference","pith_arxiv_id":"2402.07867","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Poisonedrag: Knowledge poi- soning attacks to retrieval-augmented generation of large language models","venue":"arXiv (Cornell University)","work_id":"66bdf5c5-8305-49a1-b957-9bb5993a358e","year":2024},"citing_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-05-10T19:20:52.845052Z"},"links":{"cited_paper":"/paper/2402.07867","citing_paper":"/paper/2604.04759"},"observation_digest":"sha256:b59e454ea0aa5869b8308a4397299fefbc96ba15ac9534b60d09bae8cca2ae8a","observation_id":"c0172594-d89a-4d57-8fd3-11adc1815b4f","resolution":{"observed_at":"2026-05-10T23:05:49.040793Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw"},"reference_resolution":{"displayed":22,"state_counts":{"malformed_identifier":0,"metadata_mismatch":6,"parse_uncertain":0,"unresolved":0,"verified_exact":16,"verified_fuzzy":0},"total_outbound_references":22},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"thesis":"As of 6 August 2026, this Paper Citation Record lists 22 of 22 outbound references and 12 inbound Pith citation observations for arXiv:2604.04759."}