{"as_of":"2026-08-02T19:44:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:2b83c74030e5aea7d0e845381d9b06ea34b504d9e636e4bcbfa90826cc99dfb1","coverage":[{"denominator":57,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":57,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-08T09:08:30.102711Z","state":"measured"},{"denominator":58,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":58,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-02T06:30:47.504484+00:00","state":"measured"},{"denominator":1,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":1,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-01T16:35:17.406568Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.06393","snapshot_observed_at":"2026-08-01T16:35:17.406568Z","title":"Available: https://arxiv.org/abs/2605.06393","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.17951","last_updated":"2026-07-20T13:52:24Z","snapshot_observed_at":"2026-08-01T16:35:11.384780Z","submitted_at":"2026-07-20T13:52:24Z","title":"RT-SHCUA: Real-Time Self-Hosted Computer-Use Agent for UAV Control","version":1},"reference_index":2026,"source":"pdf_text","source_observed_at":"2026-08-01T16:35:17.406568Z"},"links":{"cited_paper":"/paper/2605.06393","citing_paper":"/paper/2607.17951"},"observation_digest":"sha256:c96ad96f72fbf0d7ef1c5572d48e0b2f9f5de61bc2f3287c7f3029b8451785fd","observation_id":"cdd1d98e-bac1-4a6a-99bc-586b5e77c7e5","resolution":{"observed_at":"2026-08-01T16:35:17.406568Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2605.06393/citation-record","integrity":"/paper/2605.06393/integrity","json":"/paper/2605.06393/citation-record.json","paper":"/paper/2605.06393"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"(2026, Feb.) Openclaw vulnerability: Website-to-local agent takeover","venue":null,"work_id":"6fd3f8b0-74b8-4b16-add6-f6e5bd4efeb5","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:d0338e47cae92fcdd8798ca2fd79b18ef7a297175ddadb7c199944d6a369bb16","observation_id":"a938718d-cbc8-489d-a4e0-4caf515480f5","resolution":{"observed_at":"2026-05-26T16:27:39.773378Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"(2026, Jan.) Openclaw/clawdbot has 1-click RCE via authentication token exfiltration from gatewayurl","venue":null,"work_id":"ca144187-383d-40a2-8ce4-082287ce2592","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:4ce6e56568842f270cb95929ef482377bd5a5d7b88768d2f3bc2f8ad171ce58a","observation_id":"0b4b4f70-bf74-4bfe-9329-d953a1068b27","resolution":{"observed_at":"2026-05-26T16:27:39.764787Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"97abf63e-0517-4431-958e-0647ac99f8de","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:4380392e53abb3101819caabe834ec6285ffadb34fb7cc85099884dd34ae1ae9","observation_id":"5e1b04e0-c29f-4907-bbc3-6dae257b9c8c","resolution":{"observed_at":"2026-05-26T16:27:39.760093Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"36c319dd-d229-4f49-b9c9-b6ee52a0e42f","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:71c49b9a4b16e7feffc130e997085788585be8497cd45a4262fd1de2f2f80b0b","observation_id":"1d00f4a1-38ba-43f1-8026-d190f7616d74","resolution":{"observed_at":"2026-05-26T16:27:39.769061Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"OP-TEE (Open Portable Trusted Ex- ecution Environment)","venue":null,"work_id":"599c04c5-06db-4847-99fe-99459adebdde","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:e7a6e2ccc6830b3743e8cbc1a415b3df5eec6864173bb08d40c9a4051b350884","observation_id":"fad4c65c-8e02-43f5-a36a-5e9154213b04","resolution":{"observed_at":"2026-05-26T16:27:39.750852Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"OP-TEE Documentation","venue":null,"work_id":"183106bf-18c7-4564-9c0b-10ec93b17aad","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:f281cd70e18afdcdbde92b586bf98dea600e6b1b0b5e9d7bbd30cc94a6cb64d5","observation_id":"729c4a5c-21ab-43ec-a6de-fe4de97459fa","resolution":{"observed_at":"2026-05-26T16:27:39.746149Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Keystone: An Open Framework for Architecting Trusted Execution Environments","venue":null,"work_id":"80aa48a3-1c03-48ae-b2f3-2871d0fd487f","year":2020},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:9eba80460f2449de65aea133def8df99ee1edf1d37fed4a76a15a1f1911477f1","observation_id":"1e866452-8f82-480d-9b55-a219e09aaffa","resolution":{"observed_at":"2026-05-26T16:27:39.731695Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Keystone Enclave Documentation","venue":null,"work_id":"7feb57f2-4884-4a5d-abe4-2939cbf45093","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:2afcca49846d012172c6a687fcf9a510c583fe41906c7dd3717542285066f475","observation_id":"b791c4df-827c-42d6-89c3-d94ba8fd38b3","resolution":{"observed_at":"2026-05-26T16:27:39.736465Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Enclave Application Cache for RISC-V Keystone","venue":null,"work_id":"a88d8986-e17a-41e2-9303-47af70949c75","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:909d7a6dfffc9dd4d56c338f499cfceb12e49eb11720ff801a986312b6ae0c74","observation_id":"83fa6f85-a065-4603-9992-8591b9515393","resolution":{"observed_at":"2026-05-26T16:27:39.741545Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"(2026) Openclaw - personal AI assistant","venue":null,"work_id":"f6789187-215b-4a8f-a41b-5553846927a2","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:ba458e5fe5f028f2b3a2487ffb40cc73500cd57f217e8d8efd92b5f3badad11a","observation_id":"680bc1a0-c6e7-4d44-a5ef-231d5167017f","resolution":{"observed_at":"2026-05-26T16:27:39.755621Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Camels can use computers too: System-level security for computer use agents","venue":null,"work_id":"6d5d6bf5-683d-42c2-892f-76cf783ca756","year":null},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:fb24ba8dee3d4c4614856af294b98a55feb474e8c90d61d02f9ee8ca74db7a7a","observation_id":"e7a12b60-8192-4402-979c-f18fb8387449","resolution":{"observed_at":"2026-05-26T16:27:39.777394Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2601.09923","last_updated":"2026-06-04T15:38:02Z","snapshot_observed_at":"2026-07-06T22:41:43.594456Z","submitted_at":"2026-01-14T23:06:35Z","title":"CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents","version":3},"cited_work":{"arxiv_id":"2601.09923","doi":"10.48550/arxiv.2601.09923","metadata_source":"pith","pith_arxiv_id":"2601.09923","snapshot_observed_at":"2026-07-10T12:27:04.155502Z","title":"Camels can use computers too: System-level security for computer use agents","venue":"cs.AI","work_id":"44b54730-e6b2-4e8c-b6af-7c422996c093","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2601.09923","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:5e0f362d181034518cd09bd4ee0c20e4e7188ac9a2f15ba76c0559c820b0779f","observation_id":"80f11375-14d6-4b59-9f5b-2cbb42f59c25","resolution":{"observed_at":"2026-06-05T02:16:21.941428Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:fc067b7958ef111529700f25c9844456e0d8323af201c2c0a56b43604e053945","observation_id":"857b32e5-5f7b-45c6-a219-0997fc26a1a6","resolution":{"observed_at":"2026-05-11T20:26:11.296295Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"A systematic security evaluation of openclaw and its variants","venue":null,"work_id":"640eb21c-41d7-4445-be30-d32f16b9f797","year":null},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:8d2968835e9ad59fc39677c1d628743e206fd1d59246ce0cceacea32084d9045","observation_id":"10e9b729-e369-4008-854b-f832dc2c4825","resolution":{"observed_at":"2026-05-26T16:27:39.791050Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.03131","last_updated":"2026-04-03T15:52:36Z","snapshot_observed_at":"2026-07-06T22:52:20.577677Z","submitted_at":"2026-04-03T15:52:36Z","title":"A Systematic Security Evaluation of OpenClaw and Its Variants","version":1},"cited_work":{"arxiv_id":"2604.03131","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.03131","snapshot_observed_at":"2026-07-03T06:27:42.550738Z","title":"A Systematic Security Evaluation of OpenClaw and Its Variants","venue":"cs.CR","work_id":"22bc6f3d-dd89-4d9d-8993-2ee04896d9ce","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.03131","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:5995ca1296b72199ac2330a0a0cd3b60eec2d86bbcb05d2de45e96f682ca3778","observation_id":"e68f8a17-c9fe-47c6-9705-c693cb3197ce","resolution":{"observed_at":"2026-05-11T20:26:11.278150Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2506.02456","doi":"10.48550/arxiv.2506.02456","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"Vpi-bench: Visual prompt injection attacks for computer-use agents","venue":null,"work_id":"4edec04f-9cad-4c9f-a494-1e1fe341b706","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:3b73f335fb406ada3bbf749269b9e268b3322c11f4a4a9153e849c133695a7e5","observation_id":"39f98c1e-b1b9-4aca-87fa-7eb13a3daa37","resolution":{"observed_at":"2026-05-11T20:26:11.095045Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.28551","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"What Did It Actually Do?: Understanding risk awareness and traceability for computer-use agents","venue":null,"work_id":"4718dc42-6ece-4e53-badb-db1775b62afe","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:23618caec223993f96871047c13161d704f340e299f450c1d540bd4c741955ec","observation_id":"45dd7915-755b-42d6-ac93-a71691def5e3","resolution":{"observed_at":"2026-05-11T20:26:11.228751Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Don’t let the claw grip your hand: A security analysis and defense framework for openclaw","venue":null,"work_id":"e2f8b487-6095-4422-bf36-c3e0283fef73","year":null},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:20d8a37f5cb2b1dee504d863593553aa2c2beae290162bec5179be40b7541f62","observation_id":"8e28b5e1-9c8f-4e4f-96f1-bf64c5cc2a3e","resolution":{"observed_at":"2026-05-26T16:27:39.781871Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.10387","doi":"10.48550/arxiv.2603.10387","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"Don’t let the claw grip your hand: A security analysis and defense framework for OpenClaw","venue":null,"work_id":"419d68e7-2dfc-4480-9d0a-0da2040a78d4","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:632d26edfd777881fcb1a9bacefd3830fc4615a1d6be92f946389d2196a9110a","observation_id":"405030aa-437b-4afd-9d6d-a84e5ecb9e86","resolution":{"observed_at":"2026-05-11T20:26:11.236477Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.12644","doi":"10.48550/arxiv.2603.12644","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"Uncovering security threats and architecting defenses in autonomous agents: A case study of OpenClaw","venue":null,"work_id":"73ec2c86-6f34-4369-9dfc-340d7d3a2b77","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:6b270cfe7db81766d63fcd7ff7f7c984e88dd321e355408f7007e9ecb4aa8d96","observation_id":"f3eea4e2-db26-40ad-9ede-4fb04cf25768","resolution":{"observed_at":"2026-05-11T20:26:11.247346Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.06284","last_updated":"2026-04-07T12:19:55Z","snapshot_observed_at":"2026-07-06T22:54:48.916799Z","submitted_at":"2026-04-07T12:19:55Z","title":"ClawLess: A Security Model of AI Agents","version":1},"cited_work":{"arxiv_id":"2604.06284","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.06284","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"ClawLess: A Security Model of AI Agents","venue":"cs.CR","work_id":"ae7d7abd-09d4-4f20-83da-400ee4d6f03d","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.06284","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:c6ea2a8ece96d7dff380b18490d746363b4844aefefbab0ba4f872db65be0c5f","observation_id":"febdfbe8-d7e8-4c79-bbf1-b6ed5bb54490","resolution":{"observed_at":"2026-05-11T20:26:11.221742Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02691","last_updated":"2024-08-04T04:52:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-05T06:21:45Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","version":3},"cited_work":{"arxiv_id":"2403.02691","doi":"10.1145/3696410.3714756","metadata_source":"pith","pith_arxiv_id":"2403.02691","snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","venue":"cs.CL","work_id":"5cbfcda4-ec26-44e4-be60-e1525956d71d","year":2024},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2403.02691","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:64069d4058ac0821e6a61d3cd7a32dc284b0cb94933632da5ec4eeada31ec746","observation_id":"c0e71a4c-64d8-4714-a732-03437511829a","resolution":{"observed_at":"2026-05-13T21:40:06.567267Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-11T02:47:49.867984Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:d9fcb8324392022662ef59768522c7518e0a43b3c05e35d5cf4bdb60187b68a3","observation_id":"3790cb3c-65a3-4eb4-9d82-9fa95ff9aab5","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.02644","last_updated":"2025-05-30T03:50:33Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-10-03T16:30:47Z","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","version":4},"cited_work":{"arxiv_id":"2410.02644","doi":"10.48550/arxiv.2410.02644","metadata_source":"pith","pith_arxiv_id":"2410.02644","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","venue":"cs.CR","work_id":"15ab4a69-85ab-4295-839d-080a2cd3e7aa","year":2024},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2410.02644","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:3554c25eee801c7d6a868224ad1b11983ec1b4ad717320be0f393881cf768989","observation_id":"60c9c6e5-77ac-428d-90fa-e0414e5d0b22","resolution":{"observed_at":"2026-05-12T13:36:57.477107Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2506.14866","doi":"10.48550/arxiv.2506.14866","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"Os-harm: A benchmark for measuring safety of computer use agents","venue":null,"work_id":"e83d917b-c8de-475a-9fdd-0a1c334de498","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:9ab332b0b7c43310a5493c8733e0d22e6d4c8fa7960942e4f8cb6f0dde60b490","observation_id":"aff62ec5-9650-430a-bebc-7d87a21deba8","resolution":{"observed_at":"2026-05-11T20:26:11.272766Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.18575","last_updated":"2025-05-16T22:42:29Z","snapshot_observed_at":"2026-07-06T21:14:57.707919Z","submitted_at":"2025-04-22T17:51:03Z","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","version":3},"cited_work":{"arxiv_id":"2504.18575","doi":"10.48550/arxiv.2504.18575","metadata_source":"pith","pith_arxiv_id":"2504.18575","snapshot_observed_at":"2026-07-10T12:27:04.227834Z","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","venue":"cs.CR","work_id":"bf1914b2-fd32-4768-a4d5-84720606d71b","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2504.18575","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:9411206b8ccdead22f1130e526706d61250cf991c582ea15ff53da47f78943fb","observation_id":"b6392458-5895-4aef-bb61-063e44d78daf","resolution":{"observed_at":"2026-05-15T22:22:05.737978Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.02947","last_updated":"2026-04-03T10:29:31Z","snapshot_observed_at":"2026-07-29T16:09:43.498926Z","submitted_at":"2026-04-03T10:29:31Z","title":"AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents","version":1},"cited_work":{"arxiv_id":"2604.02947","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.02947","snapshot_observed_at":"2026-07-03T13:48:20.367069Z","title":"AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents","venue":"cs.AI","work_id":"cd51a93d-4f91-49d6-b3c8-ae00ba7d3aa0","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.02947","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:d61f351c8f63e2476b7b021a3be0d1b4773264ffe7b1c18b8921baf32cd38a70","observation_id":"1244999e-f9f3-488d-96d2-2b4c9c8f1b3d","resolution":{"observed_at":"2026-05-11T20:26:11.179617Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.01438","last_updated":"2026-04-04T15:18:43Z","snapshot_observed_at":"2026-07-06T22:51:35.522923Z","submitted_at":"2026-04-01T22:24:24Z","title":"ClawSafety: \"Safe\" LLMs, Unsafe Agents","version":2},"cited_work":{"arxiv_id":"2604.01438","doi":"10.48550/arxiv.2604.01438","metadata_source":"pith","pith_arxiv_id":"2604.01438","snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"ClawSafety: \"Safe\" LLMs, Unsafe Agents","venue":"cs.AI","work_id":"65792180-ed14-4f36-a1e6-78f74ed5224d","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.01438","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:f1cdbdba6dfc601afe632017639818ac80498dfd868e2c5391b1b52526bfc5f9","observation_id":"6515f193-6b6e-48af-b7ce-2993cb57e9fa","resolution":{"observed_at":"2026-05-11T20:26:11.194653Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.06607","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-03T12:08:07.138069Z","title":"Code agent can be an end-to-end system hacker: Benchmarking real-world threats of computer-use agent","venue":null,"work_id":"ad0b34e0-250e-4566-ae6f-7f282b91a687","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:ff89b328f7ce386f3b7bbc0876b45e4e633db6b6f9fa84ae62cd1b867fb60f38","observation_id":"124b7586-b60b-41bd-851d-d8c68926a21c","resolution":{"observed_at":"2026-05-11T20:26:11.139612Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.20708","doi":"10.48550/arxiv.2602.20708","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"ICON: Indirect prompt injection defense for agents based on inference-time correction","venue":null,"work_id":"9307fc96-12ad-410b-934b-0c80899ae112","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:380b660bc6678d55dff6c14bcb0de761d47442d11ed67cb447b251f66edba01d","observation_id":"cfbda53c-fe70-4b69-8b8e-569fbd67782f","resolution":{"observed_at":"2026-05-11T20:26:11.157152Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.01055","last_updated":"2025-06-01T15:48:06Z","snapshot_observed_at":"2026-07-06T21:34:38.683177Z","submitted_at":"2025-06-01T15:48:06Z","title":"Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution","version":1},"cited_work":{"arxiv_id":"2506.01055","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2506.01055","snapshot_observed_at":"2026-07-04T14:09:53.274632Z","title":"Simple prompt injection attacks can leak personal data observed by llm agents during task execution","venue":null,"work_id":"0f88bb16-d6ed-41c4-8b0b-49b456b6d51e","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2506.01055","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:3f71cc8f30fbeb4bf5b42c5c81d9426c42b3d6fdfde40d5b89500460acf596b4","observation_id":"c5432059-af0f-467e-850f-7cddc4d5b4f5","resolution":{"observed_at":"2026-05-11T20:26:11.150157Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.10453","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T13:39:51.337137Z","title":"arXiv preprint arXiv:2602.10453 , year=","venue":null,"work_id":"16c524eb-7f93-4bcc-bcb4-d30238f9c00a","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:183041f54bad6ed98a9790d395536115e8f640c96d4391e365302c65f24b0ded","observation_id":"7045ce5a-3719-4e0d-8e90-87a6f6e798dd","resolution":{"observed_at":"2026-05-11T20:26:11.164074Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Memory poisoning attack and defense on memory based LLM-agents","venue":null,"work_id":"24e2447d-13a5-4e91-9441-631c163d571a","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:6177ce19541af69ba4236c3f00e4b9b1057f1f6bd2bf98cad149d784bd8bf041","observation_id":"83c79e3c-d9a9-4028-a6be-b095f6633a40","resolution":{"observed_at":"2026-05-26T16:27:39.726884Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18666","last_updated":"2025-07-31T04:00:48Z","snapshot_observed_at":"2026-07-06T20:57:47.748881Z","submitted_at":"2025-03-24T13:31:48Z","title":"AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents","version":3},"cited_work":{"arxiv_id":"2503.18666","doi":"10.48550/arxiv.2503.18666","metadata_source":"pith","pith_arxiv_id":"2503.18666","snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents","venue":"cs.AI","work_id":"2d265b31-7dcb-4ab3-8c83-e13bd5598435","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2503.18666","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:62f322a1cd9a7530bb8b2862b8ee912bea1bb2abcfeccb1cfb36906d10bb071a","observation_id":"07484e74-c5af-4bfb-b66b-1f63318bdd77","resolution":{"observed_at":"2026-05-14T21:24:32.777586Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2602.16708","last_updated":"2026-05-08T15:45:27Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2026-02-18T18:57:12Z","title":"Formal Policy Enforcement for Real-World Agentic Systems","version":3},"cited_work":{"arxiv_id":"2602.16708","doi":null,"metadata_source":"pith","pith_arxiv_id":"2602.16708","snapshot_observed_at":"2026-07-11T02:47:51.036183Z","title":"Formal Policy Enforcement for Real-World Agentic Systems","venue":"cs.CR","work_id":"dc0c6fb4-ef13-485c-8109-a5a138684d7e","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2602.16708","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:11113a66561741a52af01f58406812d25cb3930336a3639baf7700f945b5f608","observation_id":"1cf11920-0b88-401c-a02d-1639deeeda9b","resolution":{"observed_at":"2026-05-12T01:43:58.132331Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2508.03858","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T00:29:16.287201Z","title":"Wang, Trisha Singhal, Ameya Kelkar, and Jason Tuo","venue":null,"work_id":"6c4b5957-7f0a-4b3b-b179-41c13b991dd3","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:19a5f94924692abad30552d63ea04af59aa170f07ce7ba630b3d597f7b94d4f5","observation_id":"3a65c88d-70c8-4b4d-b8e2-96631ab50289","resolution":{"observed_at":"2026-05-11T20:26:11.289832Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.05229","last_updated":"2026-04-06T22:49:28Z","snapshot_observed_at":"2026-07-06T22:54:00.211106Z","submitted_at":"2026-04-06T22:49:28Z","title":"From Governance Norms to Enforceable Controls: A Layered Translation Method for Runtime Guardrails in Agentic AI","version":1},"cited_work":{"arxiv_id":"2604.05229","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.05229","snapshot_observed_at":"2026-07-04T00:29:16.320431Z","title":"From Governance Norms to Enforceable Controls: A Layered Translation Method for Runtime Guardrails in Agentic AI","venue":"cs.AI","work_id":"a2b5a1a5-8802-49cf-8cc4-da503ba1285e","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.05229","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:cfb58198b69dda09c4594d93c4b8079aa7c2d93dc065016e86f55104c3804781","observation_id":"79808576-a662-47f2-8eb0-7586e30dd6d0","resolution":{"observed_at":"2026-05-11T20:26:11.112259Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.16586","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T14:09:53.182384Z","title":"Kaptein, V.-J","venue":null,"work_id":"de1091cb-8f2a-4b9e-b767-645990d8315a","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:3818c4e1dc1df5a3db294ed6b35d7368641eca505826521bc7485920aa79f37e","observation_id":"9c4d0216-016c-4e0c-b5eb-75b5c00c4ee2","resolution":{"observed_at":"2026-05-11T20:26:11.033709Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.20953","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T02:47:50.317156Z","title":"Uchibeke","venue":null,"work_id":"e707c68e-9311-4108-9524-efc7b1c3ddf6","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:c12abe3712987096eaab5fb81da0237a27ce075b70e4a2ced7c7265804f7000a","observation_id":"8ecb8f47-41c0-46c7-a2cb-fa8a78897c79","resolution":{"observed_at":"2026-05-11T20:26:10.998204Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.11703","last_updated":"2026-05-14T02:36:38Z","snapshot_observed_at":"2026-07-06T21:10:09.129714Z","submitted_at":"2025-04-16T01:58:40Z","title":"Progent: Securing AI Agents with Privilege Control","version":3},"cited_work":{"arxiv_id":"2504.11703","doi":"10.48550/arxiv.2504.11703","metadata_source":"pith","pith_arxiv_id":"2504.11703","snapshot_observed_at":"2026-07-10T12:27:04.218470Z","title":"Progent: Securing AI Agents with Privilege Control","venue":"cs.CR","work_id":"193d98f2-c913-4d0c-814e-b550a64bd03c","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2504.11703","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:ebb2cbb62f4f4c001bc64b4bf1d85c270b24dd9fd54debcc809c6b8eeee25623","observation_id":"8ae5faa8-34a4-4369-8397-0a37b9e330da","resolution":{"observed_at":"2026-05-15T01:43:10.493453Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2508.00500","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T18:00:00.393488Z","title":"Pro2Guard: Proactive runtime enforcement of LLM agent safety via probabilistic model checking","venue":null,"work_id":"d4c2a48d-ad9b-4f3b-91df-81f61d80ff64","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:a7c4e03b555bf8bc4e37ffa30f132170fd7ebc8898619d56db955ec5ca41d420","observation_id":"46bff2a8-8ccb-4bd7-8772-b4def0492778","resolution":{"observed_at":"2026-05-11T20:26:10.978771Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.22302","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-03T22:28:59.755034Z","title":"Agent Behavioral Contracts: Formal Specification and Runtime Enforcement","venue":null,"work_id":"9f9c854c-a981-4164-9adb-28fd62ffeecd","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:baf1dd545fa93f1c6bcef471b9fcc65070486c89022f793dc0374fa68bad78b5","observation_id":"8fce22f1-336f-4e23-aa2d-2f2d869a9b99","resolution":{"observed_at":"2026-05-11T20:26:10.961108Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.28166","last_updated":"2026-04-20T07:37:21Z","snapshot_observed_at":"2026-08-02T07:10:51.130581Z","submitted_at":"2026-03-30T08:35:00Z","title":"Evaluating Privilege Usage of Agents with Real-World Tools","version":2},"cited_work":{"arxiv_id":"2603.28166","doi":null,"metadata_source":"pith","pith_arxiv_id":"2603.28166","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Evaluating Privilege Usage of Agents with Real-World Tools","venue":"cs.CR","work_id":"846ef222-b04f-4285-a9e3-3f81eaa73cb3","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2603.28166","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:2e6fdc537aefe9683bf7783406646b9288397270bd02faf11510f9d8882537a2","observation_id":"00fb860b-50b0-46e9-824e-6493c1c3ed53","resolution":{"observed_at":"2026-05-11T20:26:10.968405Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.28807","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-30T07:54:22.134696Z","title":"SafeClaw-R: Risk analysis and runtime enforcement for OpenClaw skills","venue":null,"work_id":"60190bcb-d450-43f2-9341-222afdca5f1a","year":2022},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:cd745a70477d100d61c866aef38d009ac28f91306d352ee95762660ea90bfe55","observation_id":"86acbf06-b9b5-4128-b4e8-d914434b1ecf","resolution":{"observed_at":"2026-05-11T20:26:10.985007Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.12230","last_updated":"2026-04-05T08:33:19Z","snapshot_observed_at":"2026-07-06T22:48:53.198077Z","submitted_at":"2026-03-12T17:49:39Z","title":"Security Considerations for Artificial Intelligence Agents","version":2},"cited_work":{"arxiv_id":"2603.12230","doi":null,"metadata_source":"pith","pith_arxiv_id":"2603.12230","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Security Considerations for Artificial Intelligence Agents","venue":"cs.LG","work_id":"ac86548e-22d3-4f8f-9098-c77af47420b6","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2603.12230","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:3f1fafebb25fe2db2693c319f72af8ade56ca273c754da896db9d8a43aab20ef","observation_id":"fbb5e2cf-877a-421f-995f-4aaa38147dd5","resolution":{"observed_at":"2026-05-11T20:26:11.020770Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Preventing privilege escala- tion","venue":null,"work_id":"db3c4997-a0fb-4941-840a-e534f89d2b34","year":2003},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:9359f1f978b7c1ed5ca2783336c20e3f3b0579bd4249574e10a23a9f1950be64","observation_id":"0b7bd804-a764-4f99-b017-a16b441fc0fd","resolution":{"observed_at":"2026-05-26T16:27:39.795252Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Enforceable security policies","venue":null,"work_id":"21074288-e19f-47f3-af9a-edd9b65fb967","year":2000},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:53da4be9492e17f131fefbf850bd65cff3176ccf29b558f3f4c5796e3ba7521b","observation_id":"aaf89c1e-2d1b-40a6-92d3-be094afd834e","resolution":{"observed_at":"2026-05-08T22:24:19.059649Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"SC-11: Trusted Path","venue":null,"work_id":"554b4b5c-771a-465a-8c7d-adf6f5a32b12","year":2020},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:c92e1af7b00bb74ba68c145acd74aaf9c49b1af33f8dcba95133f94009d72f9c","observation_id":"18ac8001-21ab-4c87-a6d5-5765c533885b","resolution":{"observed_at":"2026-05-26T16:27:39.721928Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1109/csf.2008.24","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Evidence- based audit","venue":null,"work_id":"483b8d67-9a63-463f-b846-fca7eee41724","year":2008},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:77c0c6b6701e06ee45f47181b1ccdfdb2a3e11093f1567091f2450f337e84e01","observation_id":"2b6a1e22-f50d-4448-ae00-ce754119e139","resolution":{"observed_at":"2026-05-08T22:24:19.064342Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2512.01295","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T02:47:50.063911Z","title":"Systems security foundations for agentic computing","venue":null,"work_id":"f9165bc7-0f01-458f-9b95-f4be76e21b26","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:18d91e54f7c473455fabd0656e856d86995d3a6d3556dc3db00447ad28dfe0f2","observation_id":"37192e4b-2743-420c-b239-cf356377d326","resolution":{"observed_at":"2026-05-11T20:26:11.044363Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2406.02630","doi":"10.48550/arxiv.2406.02630","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"Ai agents under threat: A survey of key security challenges and future pathways","venue":null,"work_id":"fee97178-2c2c-4126-b6e2-9bd883f9a4c1","year":2024},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:cc229d907c8eb10edbf8183fb036b18ea557b45c4a7ce392477dee452b71ce5c","observation_id":"7e382754-e76c-4c4a-8122-4a3bc07887d8","resolution":{"observed_at":"2026-05-11T20:26:11.067357Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-07-06T21:21:20.149404Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:4333f563ad59e6912aea659c4d2e86d5286d7883269312f8d78d4d6405eb013d","observation_id":"e01b55d3-0550-41b1-b9e0-7a7aaf50e233","resolution":{"observed_at":"2026-05-11T20:26:11.054246Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.12784","last_updated":"2024-07-17T17:59:47Z","snapshot_observed_at":"2026-07-06T18:47:56.109836Z","submitted_at":"2024-07-17T17:59:47Z","title":"AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases","version":1},"cited_work":{"arxiv_id":"2407.12784","doi":"10.48550/arxiv.2407.12784","metadata_source":"pith","pith_arxiv_id":"2407.12784","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases","venue":"cs.LG","work_id":"fd576f32-99d7-40a6-866a-ad86ad47565d","year":2024},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2407.12784","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:fe843ccbf541a9be1ed276444e1db75f3afbdc1af2c44279bcf4e4be09aa96b8","observation_id":"feca86c2-699d-439c-862d-c539df9af9d4","resolution":{"observed_at":"2026-05-11T20:26:11.087888Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Poison once, exploit forever: Environment-injected memory poisoning attacks on web agents","venue":null,"work_id":"cda4fe95-fe63-40ee-8fec-218bb7616012","year":null},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:88d31b3cd166ff686cfbd16923cbeed9935bd57fa9f43b5cd6361488f97a2947","observation_id":"812bbb9c-6812-4222-8e0f-6b0884b22141","resolution":{"observed_at":"2026-05-26T16:27:39.717404Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.02623","last_updated":"2026-04-07T14:45:15Z","snapshot_observed_at":"2026-07-06T22:51:57.889822Z","submitted_at":"2026-04-03T01:25:12Z","title":"Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents","version":2},"cited_work":{"arxiv_id":"2604.02623","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.02623","snapshot_observed_at":"2026-07-03T05:57:41.940009Z","title":"Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents","venue":"cs.CR","work_id":"b00d3f50-24e0-4812-87e0-eb47767f463f","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.02623","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:ad8fc1c0193a8530d977813c67d4d9fa21e1de753ce01d50ce46e010fe37988b","observation_id":"ca9a4bb9-9268-419a-bee3-71963bd3fa48","resolution":{"observed_at":"2026-05-11T20:26:11.122650Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2601.17548","doi":"10.48550/arxiv.2601.17548","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T02:47:50.849333Z","title":"Maloyan and D","venue":null,"work_id":"16c69ef7-00fc-4f32-bd01-e17005fa7480","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:a53c6e3f538a84b79ef03dfb6ff8267474f51ba904b4665d3c6c42efe5585729","observation_id":"ed97e1cc-5655-45ed-b989-7a0abf94d55a","resolution":{"observed_at":"2026-05-11T20:26:11.009072Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"His research interests include trusted com- puting, confidential computing, system and network security","venue":null,"work_id":"d030abd8-ce98-4845-b339-a73a772a470f","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:2dd464351a795504d7da01847759645e07714086631074612aeaf6da7546fc42","observation_id":"dd7c609b-319f-4a4d-8f9d-500d6728a290","resolution":{"observed_at":"2026-05-26T16:27:39.786529Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-02T06:30:47.504484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation"},"reference_resolution":{"displayed":57,"state_counts":{"malformed_identifier":0,"metadata_mismatch":9,"parse_uncertain":0,"unresolved":2,"verified_exact":30,"verified_fuzzy":16},"total_outbound_references":57},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-02T06:30:47.504484+00:00","source":"crossref"},{"observed_at":"2026-08-02T06:30:44.765945+00:00","source":"retraction_watch"}],"thesis":"As of 2 August 2026, this Paper Citation Record lists 57 of 57 outbound references and 1 inbound Pith citation observation for arXiv:2605.06393."}