{"as_of":"2026-08-05T03:57:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:9f3e8d48154fbeb6be37a86c8b968367f45d6aa5cc400eb7a50989e9e3bb746f","coverage":[{"denominator":30,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":30,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-10T00:02:35.167281Z","state":"measured"},{"denominator":32,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":32,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-04T06:34:03.388597+00:00","state":"measured"},{"denominator":2,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":2,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-13T17:08:58.831798Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-07-02T21:07:23.686230Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.20994","snapshot_observed_at":"2026-07-13T17:08:58.831798Z","title":"Kelleher","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2605.02900","last_updated":"2026-05-24T13:33:45Z","snapshot_observed_at":"2026-08-02T11:46:07.449862Z","submitted_at":"2026-03-28T13:21:44Z","title":"Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-07-13T17:08:58.831798Z"},"links":{"cited_paper":"/paper/2604.20994","citing_paper":"/paper/2605.02900"},"observation_digest":"sha256:b536728797e5ccb5e8b4551dc22dc263f1565e1b037ea864bee804f7499f76af","observation_id":"41f00fa2-d1d9-4298-8c44-af22c0bb7a4b","resolution":{"observed_at":"2026-07-13T17:08:58.831798Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"cited_work":{"arxiv_id":"2604.20994","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.20994","snapshot_observed_at":"2026-07-02T21:07:23.686230Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","venue":"cs.CR","work_id":"1f139307-8f7f-4ea4-b864-69e5352f6666","year":2026},"citing_paper":{"arxiv_id":"2606.07992","last_updated":"2026-06-06T06:07:52Z","snapshot_observed_at":"2026-08-03T00:26:10.593406Z","submitted_at":"2026-06-06T06:07:52Z","title":"VATS: Exploiting Implicit Authority in Error-Path Injection via Systematic Mutation","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-06-27T19:57:39.536382Z"},"links":{"cited_paper":"/paper/2604.20994","citing_paper":"/paper/2606.07992"},"observation_digest":"sha256:b4033bb4eac0bf20929eebc7cb281d5cc989da8f24668880db7856181a88d3cb","observation_id":"963af959-715f-47af-b5c2-8fddfb2a0997","resolution":{"observed_at":"2026-07-02T21:07:23.687656Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2604.20994/citation-record","integrity":"/paper/2604.20994/integrity","json":"/paper/2604.20994/citation-record.json","paper":"/paper/2604.20994"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2407.00121","last_updated":"2024-06-27T17:47:26Z","snapshot_observed_at":"2026-07-06T18:38:42.333605Z","submitted_at":"2024-06-27T17:47:26Z","title":"Granite-Function Calling Model: Introducing Function Calling Abilities via Multi-task Learning of Granular Tasks","version":1},"cited_work":{"arxiv_id":"2407.00121","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.00121","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"OWASP Foundation","venue":null,"work_id":"edc15fce-3917-4a59-a74d-94c7880fc5d0","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2407.00121","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:80b29aa430c0bbb3888982b111b96179b8e1931f0c93dee68c368837e30fd014","observation_id":"e4be9763-e351-48c1-bb75-2a9280a79105","resolution":{"observed_at":"2026-05-10T00:29:47.772642Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.09024","last_updated":"2025-04-18T14:30:31Z","snapshot_observed_at":"2026-08-02T12:38:54.249632Z","submitted_at":"2024-10-11T17:39:22Z","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","version":3},"cited_work":{"arxiv_id":"2410.09024","doi":"10.48550/arxiv.2410.09024","metadata_source":"pith","pith_arxiv_id":"2410.09024","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","venue":"cs.LG","work_id":"788aad10-421f-48d7-886c-792665914606","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2410.09024","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:381c96df3a3f73d63425076553d6c71c95e6566fede3f06a7224df8371c6707e","observation_id":"4b5adb7b-2248-4cc5-a054-bf2d1a76f191","resolution":{"observed_at":"2026-05-14T01:35:51.514012Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02153","last_updated":"2025-09-15T22:15:00Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-06-02T18:35:16Z","title":"Small Language Models are the Future of Agentic AI","version":2},"cited_work":{"arxiv_id":"2506.02153","doi":"10.48550/arxiv.2506.02153","metadata_source":"pith","pith_arxiv_id":"2506.02153","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Small Language Models are the Future of Agentic AI","venue":"cs.AI","work_id":"ba0f0305-4a51-48fd-a13f-201439a18f9e","year":2025},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2506.02153","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:78332d0d9bd95aaec6830da1b138492548e21829ae327cb1c127b86a65715c1f","observation_id":"6c886954-712d-4542-ac42-c766f3e6cdc6","resolution":{"observed_at":"2026-05-16T11:55:51.260368Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-10T01:20:11.837567+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-10T01:20:11.837567+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:3b3729779734caa81a51fc1823947bf80c75f47d1474a26780fccaf65d6b9255","observation_id":"942fe2a4-f747-4c9d-aa45-a1df055c4578","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.24963/ijcai.2024/890","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T11:37:03.070551Z","title":"Chawla, Olaf Wiest, and Xiangliang Zhang","venue":"Proceedings of the Thirty-ThirdInternational Joint Conference on Artificial Intelligence","work_id":"67a16baa-abd0-4f7e-a416-8c3f4636e8da","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:2f7c0e2010bb45564b1516983111deccfe8a1b9be5066a1b2d8c37a5e7ea8f25","observation_id":"f9ba968a-dc4f-4755-a7b2-b42164db25e1","resolution":{"observed_at":"2026-05-10T00:04:46.236627Z","resolver_source":"doi","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-11T17:19:09.686361+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-11T17:19:09.686361+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.12329","last_updated":"2024-12-07T23:09:49Z","snapshot_observed_at":"2026-07-06T17:32:24.161667Z","submitted_at":"2024-02-19T18:01:36Z","title":"Query-Based Adversarial Prompt Generation","version":2},"cited_work":{"arxiv_id":"2402.12329","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2402.12329","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"arXiv preprint arXiv:2402.12329 (2024)","venue":null,"work_id":"8f36413f-b5f1-4691-bc32-5a2b817e5b7a","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2402.12329","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:7a785da7620df8314eafeca1cd55bf0d434f1390c15328258457c8234eb888ec","observation_id":"156d8fa3-11f2-42e5-a6fe-24e5a888c145","resolution":{"observed_at":"2026-05-10T00:29:47.789994Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2407.19354","doi":"10.48550/arxiv.2407.19354","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"The emerged security and privacy of llm agent: A survey with case studies","venue":null,"work_id":"24043853-2d1b-4a0d-a8dd-5017c0f29a56","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:a248041db2fa98b15e8f99f18472604c2b842906f37901ad675527851af8776c","observation_id":"d7f29649-64cd-4a86-b9f0-7bcdde9c91f9","resolution":{"observed_at":"2026-05-10T00:29:47.787301Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.23278","last_updated":"2025-10-07T07:13:32Z","snapshot_observed_at":"2026-07-06T21:00:55.979837Z","submitted_at":"2025-03-30T01:58:22Z","title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions","version":3},"cited_work":{"arxiv_id":"2503.23278","doi":"10.48550/arxiv.2503.23278","metadata_source":"pith","pith_arxiv_id":"2503.23278","snapshot_observed_at":"2026-07-11T02:47:49.588216Z","title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions","venue":"cs.CR","work_id":"3eff6b57-ab58-474f-afd9-4e115a5818a9","year":2025},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2503.23278","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:6355033125c3ea3469cdf6eca47620dc75cb8c77f12fcea1774cdb92d27a4a3f","observation_id":"227a1749-99fb-4149-bae1-a53b15c84a7c","resolution":{"observed_at":"2026-05-13T09:02:40.585277Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-05-24T11:23:19.786497+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-24T11:23:19.786497+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06825","last_updated":"2023-10-10T17:54:58Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-10T17:54:58Z","title":"Mistral 7B","version":1},"cited_work":{"arxiv_id":"2310.06825","doi":"10.48550/arxiv.2310.06825","metadata_source":"pith","pith_arxiv_id":"2310.06825","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Mistral 7B","venue":"cs.CL","work_id":"eb5e1305-ad11-4875-ad8d-ad8b8f697599","year":2023},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2310.06825","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:df267239c7968abe09beba9f285bc0be1389c0b13778a95cb4942e83371e6641","observation_id":"d56d398c-4e71-4cd6-91c9-fa5700afdec0","resolution":{"observed_at":"2026-05-10T00:29:47.774935Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-02T03:08:12.282824+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-02T03:08:12.282824+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.19277","last_updated":"2025-04-27T15:26:51Z","snapshot_observed_at":"2026-07-06T21:15:25.985791Z","submitted_at":"2025-04-27T15:26:51Z","title":"Small Models, Big Tasks: An Exploratory Empirical Study on Small Language Models for Function Calling","version":1},"cited_work":{"arxiv_id":"2504.19277","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2504.19277","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Wilhelm Kirch (ed.).Pearson’s Correlation Coefficient, pp","venue":null,"work_id":"39e66dd2-de5b-430a-b1f0-690ea20537aa","year":2025},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2504.19277","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:04ccdb7180b3f2011438b60db6c0d157ce356539d0389a206176b434358728c0","observation_id":"95b25623-fede-414c-b7de-4d378bd9519f","resolution":{"observed_at":"2026-05-10T00:29:47.784411Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1007/978-1-4020-5614-7_2569","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"doi: 10.1007/978-1-4020-5614-7_2569","venue":null,"work_id":"a4794aa9-8737-42a5-bb9e-b2c6acffc451","year":null},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:014b9475504adaef471b17abbf66aba2d97c339817f06ff29de5391660eaa9a9","observation_id":"a40a26bd-59da-47bb-b83b-997e5a0930c4","resolution":{"observed_at":"2026-05-10T00:04:46.238341Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-07-06T16:28:55.209047Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":"2310.04451","doi":"10.48550/arxiv.2310.04451","metadata_source":"pith","pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","venue":"cs.CL","work_id":"3b676de6-edef-4976-a8b5-082d4ff50867","year":2023},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:b17b25b77a0ba0da0ed8b986e1acb6544070be3b1bc6eb0a2e962e5b3338a420","observation_id":"e999f22a-0af0-43b5-95af-3016b0ce9367","resolution":{"observed_at":"2026-05-12T16:28:04.131927Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-05-23T04:52:41.614605+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-23T04:52:41.614605+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.18890","last_updated":"2024-10-24T16:27:35Z","snapshot_observed_at":"2026-07-06T19:39:10.669393Z","submitted_at":"2024-10-24T16:27:35Z","title":"Improving Small-Scale Large Language Models Function Calling for Reasoning Tasks","version":1},"cited_work":{"arxiv_id":"2410.18890","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2410.18890","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"OpenAI and al","venue":null,"work_id":"2a106f23-eeae-4cd2-b259-3b860fc5f60f","year":null},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2410.18890","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:8d3702b80f7ab787fbc38597c318e5830e229d22098c81696d27579814d5522b","observation_id":"452cc3db-cb36-4c5e-b5e8-bcd4e90e7e7e","resolution":{"observed_at":"2026-05-10T00:29:47.792643Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":"2303.08774","doi":"10.1002/tea.20265","metadata_source":"pith","pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"GPT-4 Technical Report","venue":"cs.CL","work_id":"b928e041-6991-4c08-8c81-0359e4097c7b","year":2023},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:5b5cee8cd197725df9a96e6de644b7fff8927fb3153fce4a6698d40ec3bda909","observation_id":"6f45da65-d33e-4a4d-87f4-1d2a979c383c","resolution":{"observed_at":"2026-05-10T00:29:47.728581Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2305.15334","last_updated":"2023-05-24T16:48:11Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-05-24T16:48:11Z","title":"Gorilla: Large Language Model Connected with Massive APIs","version":1},"cited_work":{"arxiv_id":"2305.15334","doi":"10.48550/arxiv.2305.15334","metadata_source":"pith","pith_arxiv_id":"2305.15334","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Gorilla: Large Language Model Connected with Massive APIs","venue":"cs.CL","work_id":"126a464a-4a73-495f-b669-de1e44aa8f09","year":2023},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2305.15334","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:a3806cb90ef4dffb2d9ac450f9342268eed5fb5544eb2f9b332e83de4cc0983f","observation_id":"2d04e746-dd57-4d8e-866e-52c4fcad3630","resolution":{"observed_at":"2026-05-11T23:22:17.488448Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.09388","last_updated":"2025-05-14T13:41:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-05-14T13:41:34Z","title":"Qwen3 Technical Report","version":1},"cited_work":{"arxiv_id":"2505.09388","doi":"10.1016/j.aiopen.2022.12","metadata_source":"pith","pith_arxiv_id":"2505.09388","snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"Qwen3 Technical Report","venue":"cs.CL","work_id":"25a4e30c-1232-48e7-9925-02fa12ba7c9e","year":2025},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2505.09388","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:1433d777fb4b09f78228cf77abf63022813afb01d81ecb6a51797b4ecd7c83f2","observation_id":"7982d7b7-2af6-4a08-a5b1-15d8a876b20f","resolution":{"observed_at":"2026-05-10T00:29:47.722945Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2409.15398","last_updated":"2024-09-23T10:18:10Z","snapshot_observed_at":"2026-07-06T19:20:42.231272Z","submitted_at":"2024-09-23T10:18:10Z","title":"Attack Atlas: A Practitioner's Perspective on Challenges and Pitfalls in Red Teaming GenAI","version":1},"cited_work":{"arxiv_id":"2409.15398","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2409.15398","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Rawat, S","venue":null,"work_id":"bdece4f8-3627-451c-bc76-0b26abf7016b","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2409.15398","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:9345270521c128371541a1cd0958f3f8496e01cc305904c3bcf948d3b5497f27","observation_id":"c6035f76-126d-426f-8739-e91c2e80ec34","resolution":{"observed_at":"2026-05-10T00:29:47.734221Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2302.04761","last_updated":"2023-02-09T16:49:57Z","snapshot_observed_at":"2026-07-06T14:50:07.491434Z","submitted_at":"2023-02-09T16:49:57Z","title":"Toolformer: Language Models Can Teach Themselves to Use Tools","version":1},"cited_work":{"arxiv_id":"2302.04761","doi":"10.48550/arxiv.2302.04761","metadata_source":"pith","pith_arxiv_id":"2302.04761","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Toolformer: Language Models Can Teach Themselves to Use Tools","venue":"cs.CL","work_id":"9bce40c8-cfd7-4983-80e0-c3bd4402322a","year":2023},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2302.04761","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:c62ef0c1146f184cf131b9c2f8c79ca98bc869dbfe3b30a4dd54788fc2891aa0","observation_id":"e23a0ec1-bcb9-40b5-b5d6-74cb965e43f5","resolution":{"observed_at":"2026-05-10T19:57:53.077868Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T01:08:11.107254+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-04T01:08:11.107254+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2302.13971","last_updated":"2023-02-27T17:11:15Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-02-27T17:11:15Z","title":"LLaMA: Open and Efficient Foundation Language Models","version":1},"cited_work":{"arxiv_id":"2302.13971","doi":"10.48550/arxiv.2302.13971","metadata_source":"pith","pith_arxiv_id":"2302.13971","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"LLaMA: Open and Efficient Foundation Language Models","venue":"cs.CL","work_id":"c018fc23-6f3f-4035-9d02-28a2173b2b9d","year":2023},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2302.13971","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:b020095eaa14614e7559ba4e7afe1754ce3f1f5eaea89cf135734a67836793a9","observation_id":"9c946c59-4198-4ad6-be0a-9ff4891064c5","resolution":{"observed_at":"2026-05-10T00:29:47.750810Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-01T11:08:05.851253+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-01T11:08:05.851253+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1007/s11704-024-40231-1","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T13:37:06.774536Z","title":"Frontiers Comput","venue":"Frontiers of Computer Science","work_id":"c00808e5-64e6-4bbb-9a05-230c05403bff","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:447c0be2ec0a5d97d90f5ba16fc123791099b4110e563ba321c84416c3299c17","observation_id":"bb5daf56-e290-461f-a095-2bd4174dd0e7","resolution":{"observed_at":"2026-05-10T00:04:46.240745Z","resolver_source":"doi","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-11T01:49:36.593873+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-11T01:49:36.593873+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2505.11154","doi":"10.48550/arxiv.2505.11154","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Mpma: Preference manipulation attack against model context protocol","venue":"ArXiv.org","work_id":"a2dcd840-29d4-4ee6-b5dc-2eff7e281fb5","year":2025},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:f7f2da698354c07fdadc3a4f486988238f88f919d2159e24ccb3f2758c40385a","observation_id":"2314d07c-6aad-44e6-8562-809e02a38862","resolution":{"observed_at":"2026-05-10T00:29:47.753365Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.16779","last_updated":"2025-03-21T01:26:12Z","snapshot_observed_at":"2026-07-06T20:56:27.310542Z","submitted_at":"2025-03-21T01:26:12Z","title":"Chain-of-Tools: Utilizing Massive Unseen Tools in the CoT Reasoning of Frozen Language Models","version":1},"cited_work":{"arxiv_id":"2503.16779","doi":"10.48550/arxiv.2503.16779","metadata_source":"arxiv_reference","pith_arxiv_id":"2503.16779","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Chain-of-Tools: Utilizing massive unseen tools in the CoT reasoning of frozen language models","venue":"ArXiv.org","work_id":"2ae0f20e-a3e6-4523-95a2-18218de8e4a7","year":2025},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2503.16779","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:ad171eb1b9c03f8a6d1f2f6ae1ffbd463ca613c770d08d6cbc326400bf2c09c0","observation_id":"0b3a85a4-9a7b-4349-aa8a-f0e25ef55c1f","resolution":{"observed_at":"2026-05-10T00:29:47.756025Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.17915","last_updated":"2024-12-24T09:35:05Z","snapshot_observed_at":"2026-08-02T03:32:23.832727Z","submitted_at":"2024-07-25T10:09:21Z","title":"The Dark Side of Function Calling: Pathways to Jailbreaking Large Language Models","version":4},"cited_work":{"arxiv_id":"2407.17915","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.17915","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"The dark side of function calling: Pathways to jailbreaking large language models","venue":null,"work_id":"063ec0c4-451d-4603-b7ba-fd2455924264","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2407.17915","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:19d75bbccadd2e8ace901207868b68763f1fae5540cd04f4556c720184bdd648","observation_id":"d694d785-c614-4000-8372-1e35e787a8c8","resolution":{"observed_at":"2026-05-10T00:29:47.731340Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2210.03629","last_updated":"2023-03-10T01:00:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-10-06T01:00:32Z","title":"ReAct: Synergizing Reasoning and Acting in Language Models","version":3},"cited_work":{"arxiv_id":"2210.03629","doi":"10.48550/arxiv.2210.03629","metadata_source":"pith","pith_arxiv_id":"2210.03629","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"ReAct: Synergizing Reasoning and Acting in Language Models","venue":"cs.CL","work_id":"407a2351-25f1-497d-b611-f77d0292a8e6","year":2022},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2210.03629","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:6be300d1dc0458fa041443409eb3a05743d3b661a1e18b5d42c01396ce7fe065","observation_id":"5d83d633-9d93-4bde-bcee-02774333068e","resolution":{"observed_at":"2026-05-10T00:29:47.743040Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-12T03:19:36.897515+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-12T03:19:36.897515+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.04295","last_updated":"2024-08-30T11:57:47Z","snapshot_observed_at":"2026-08-04T23:34:13.332065Z","submitted_at":"2024-07-05T06:57:30Z","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","version":2},"cited_work":{"arxiv_id":"2407.04295","doi":"10.48550/arxiv.2407.04295","metadata_source":"pith","pith_arxiv_id":"2407.04295","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","venue":"cs.CR","work_id":"0ee7fc45-ae61-432b-83ac-f1d93ccd88fb","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2407.04295","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:8b8348ec13f5cdb221db2aed072095fb83a33d82fb39040472f37008dda05164","observation_id":"f11bf409-6bfd-486f-beaf-4fbf122d1bc6","resolution":{"observed_at":"2026-05-15T02:20:44.922788Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-05-24T00:53:04.67981+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-24T00:53:04.67981+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2405.20653","last_updated":"2025-06-17T03:03:45Z","snapshot_observed_at":"2026-07-06T18:23:10.807498Z","submitted_at":"2024-05-31T07:41:03Z","title":"Mind the Inconspicuous: Revealing the Hidden Weakness in Aligned LLMs' Refusal Boundaries","version":3},"cited_work":{"arxiv_id":"2405.20653","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2405.20653","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Enhancing jailbreak attack against large language models through silent tokens","venue":null,"work_id":"c631bee8-b687-4d33-acd2-127688801b28","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2405.20653","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:a2f9705a260ecc063ded3707b11492dc56545dbb78990f7a6d6bac77fe444b1e","observation_id":"f64c2241-ab4f-42e4-8de0-401a934a4e77","resolution":{"observed_at":"2026-05-10T00:29:47.739027Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":"2407.20859","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":"5d974f12-7aa9-48ab-91d4-b739092384cb","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:898047cfb8e34fda2f7466c085c569ee92cb9b896fd6cb3cb3367e4cc836593c","observation_id":"00c339ae-648a-41f4-b060-8eb944fbb130","resolution":{"observed_at":"2026-05-10T00:29:47.748410Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.04313","last_updated":"2024-07-12T16:51:07Z","snapshot_observed_at":"2026-07-06T18:26:42.010940Z","submitted_at":"2024-06-06T17:57:04Z","title":"Improving Alignment and Robustness with Circuit Breakers","version":4},"cited_work":{"arxiv_id":"2406.04313","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2406.04313","snapshot_observed_at":"2026-07-04T20:00:07.967572Z","title":"https: //arxiv.org/abs/2406.04313.arXiv(2024)","venue":null,"work_id":"2145f7d3-5c56-458e-90f1-43d172ec2654","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2406.04313","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:a16d2fdb1d6d308715faf9924826cc19e7658c10f4f6d58453962207ef919a55","observation_id":"235710f3-2205-4509-96fa-ec57a0c3c973","resolution":{"observed_at":"2026-05-10T00:29:47.745676Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Figures (1), (2) and (3) detail the prompts used for the reformulation (1) and argument-variation (2), and multi-intent variation (3) strategies, respectively","venue":null,"work_id":"4f599dcb-5661-471f-9bc2-1805ccdc5a5f","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:64d753a59409e09a4264fa9e869878d29f5d60d6e1bd535db7d1ae162c44b68e","observation_id":"55bc25ac-1d02-482e-befe-76950f5529ff","resolution":{"observed_at":"2026-05-23T11:52:56.817923Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Specifically, we observe a peak on lower values for strategy (3), representing the queries containing different intents from the original prompt","venue":null,"work_id":"50ed66e9-7caf-47cf-ac2a-e1e8ec924f75","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:df614de6717356cda3afa242ddde5ad0d74f12c7197e9ded12870ec21c0c4aae","observation_id":"cc40ab87-f257-499d-95f7-f05b57d056ad","resolution":{"observed_at":"2026-05-23T11:52:56.822538Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models"},"reference_resolution":{"displayed":30,"state_counts":{"malformed_identifier":0,"metadata_mismatch":18,"parse_uncertain":0,"unresolved":0,"verified_exact":10,"verified_fuzzy":2},"total_outbound_references":30},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"thesis":"As of 5 August 2026, this Paper Citation Record lists 30 of 30 outbound references and 2 inbound Pith citation observations for arXiv:2604.20994."}