{"as_of":"2026-08-13T14:15:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:7ef58a9ddf1e460afac06b4aa34e29d130f513c69fe76f53230771cb751e28a4","coverage":[{"denominator":50,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":50,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-19T23:26:15.658106Z","state":"measured"},{"denominator":50,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":50,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-13T06:32:02.005865+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2605.17453/citation-record","integrity":"/paper/2605.17453/integrity","json":"/paper/2605.17453/citation-record.json","paper":"/paper/2605.17453"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2309.15817","last_updated":"2024-05-17T17:17:45Z","snapshot_observed_at":"2026-07-06T16:24:30.545494Z","submitted_at":"2023-09-25T17:08:02Z","title":"Identifying the Risks of LM Agents with an LM-Emulated Sandbox","version":2},"cited_work":{"arxiv_id":"2309.15817","doi":"10.48550/arxiv.2309.15817","metadata_source":"pith","pith_arxiv_id":"2309.15817","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Identifying the Risks of LM Agents with an LM-Emulated Sandbox","venue":"cs.AI","work_id":"3d4c3b66-d749-4939-b1bc-62b10b2ebbb6","year":2023},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2309.15817","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:d0d49df9a7c2acab63c9e708d020090e7212ce65427c9927b82b037c91e33f06","observation_id":"95d54b84-5037-45e3-8a53-b04561ee007f","resolution":{"observed_at":"2026-05-19T23:27:52.388844Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Stabletoolbench: Towards stable large-scale benchmarking on tool learning of large language models","venue":null,"work_id":"ff6a6612-7102-422d-8755-6737e77bab2c","year":2024},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:911df0b02923803841f881eb423f9cd7906f01f99473667c4a8a4ac6ccc7af0d","observation_id":"355baa8a-bbaf-47e9-9df6-175720873aab","resolution":{"observed_at":"2026-05-19T23:27:53.259922Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Toolsandbox: A stateful, conversational, inter- active evaluation benchmark for llm tool use capabilities","venue":null,"work_id":"7672e9c0-db5a-41db-8282-2f27e81b0489","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:8f8c70c222c821d6bc7de6b56bc050e05edf20db9c53cef9d4fc4cf5c1dbff16","observation_id":"8eddef7a-33df-4682-9d48-20aa3177e5a4","resolution":{"observed_at":"2026-05-19T23:27:53.203426Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.25726","doi":"10.48550/arxiv.2510.25726","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"10 Guoqing Ma, Jia Zhu, Hanghui Guo, Weijie Shi, Yue Cui, Jiawei Shen, Zilong Li, and Yidan Liang","venue":"Open MIND","work_id":"9263d28f-4683-4cd6-8a1e-5f6b1e15f3a2","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:20d01e8b560c8e4b9f7130cc3bc5e403a51201b51c5b8f249bcc195446aeb226","observation_id":"14ab0792-eb6d-4bea-84b0-4c1c487d8688","resolution":{"observed_at":"2026-05-19T23:27:52.401137Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection","venue":null,"work_id":"d0cff0ab-f525-4eb0-918f-be91aeff3786","year":2023},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:4f66e5da2cb2f03999d020c69ae6ea7e0e5b300470e2e6f5956484b79877fb4e","observation_id":"7aefcc1d-0de4-4dc1-b02f-74d1aa71de71","resolution":{"observed_at":"2026-05-19T23:27:53.235138Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Benchmarking and defending against indirect prompt injection attacks on large language models","venue":null,"work_id":"2aaefd90-42b9-4fd1-a245-9ce3f96990c7","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:e9de8977ce4817153a5271c3ace617ae316904d4fd00a6bc156bad8dac679c2b","observation_id":"63a3a162-0aa1-4310-b58d-80a4ad02de2e","resolution":{"observed_at":"2026-05-19T23:27:53.249277Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents","venue":null,"work_id":"0b72b87c-d8c1-47a1-9e70-1e34880fc3f1","year":2024},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:f2c1d41f5e69dab34687e8267eed8d9b14d1ad3269c166d66d76b859777f823f","observation_id":"1f0bcdfe-3175-49be-94c1-a37d22fb733e","resolution":{"observed_at":"2026-05-19T23:27:53.198732Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-07T21:04:08.189790Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents.Advances in Neural Information Processing Systems, 37:82895–82920","venue":null,"work_id":"fed2474f-2714-447a-a0ba-244de606c84c","year":2024},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:0fd2a6bf5f1d3358018c8ccaf4c7c9f3061720220c0f1eca0c75d5f4167750c1","observation_id":"7d17e26e-6f7f-49b5-9d46-1694c640d5b4","resolution":{"observed_at":"2026-05-19T23:27:53.194418Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.02644","last_updated":"2025-05-30T03:50:33Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-10-03T16:30:47Z","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","version":4},"cited_work":{"arxiv_id":"2410.02644","doi":"10.48550/arxiv.2410.02644","metadata_source":"pith","pith_arxiv_id":"2410.02644","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","venue":"cs.CR","work_id":"15ab4a69-85ab-4295-839d-080a2cd3e7aa","year":2024},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2410.02644","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:e7b86dd285fe297b118c8c205b653760d4996ea854df3d9e2a16b24b54a7eff8","observation_id":"80704353-e5d1-47cb-8147-d0976cf8267d","resolution":{"observed_at":"2026-05-19T23:27:52.612366Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-12T14:59:28.289763Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":"2508.14925","doi":"10.48550/arxiv.2508.14925","metadata_source":"pith","pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Wang, MCPTox: A systematic benchmark for MCP server security, arXiv preprint arXiv:2508.14925 (2025)","venue":"cs.CR","work_id":"53c44cac-ba71-4460-afef-2280250ee899","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:8ceda8e2fda779ba76d8342bca440832ed6d53e1e8fb733a7fbed4a0cbfec9cc","observation_id":"ed513a7c-7cfb-4e25-9757-4157bba206be","resolution":{"observed_at":"2026-05-19T23:27:52.575901Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2601.07395","doi":"10.48550/arxiv.2601.07395","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Mcp-itp: An automated framework for implicit tool poisoning in mcp","venue":"arXiv (Cornell University)","work_id":"53b67a64-94b0-4ced-9ff7-5cf5ac26ed3f","year":2026},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:82480806b87c349207ae4125c82fcb7c9e520ef9c44f239fdf0a22c451db7e92","observation_id":"aaafa9fe-ca11-44e7-985e-e74772f91982","resolution":{"observed_at":"2026-05-19T23:27:52.518906Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.24203","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Invisible threats from model context protocol: Generating stealthy injection payload via tree-based adaptive search","venue":null,"work_id":"59f28c42-c421-438c-a896-33e4f95e3ee2","year":2026},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:ba4cf2a638ee5a6b19290b501add6034f91bba121e00a378a50751e807033c21","observation_id":"3087fba8-ba75-4b63-a545-65577d239804","resolution":{"observed_at":"2026-05-19T23:27:52.362575Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2601.17549","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T09:19:43.635386Z","title":"Breaking the protocol: Security anal- ysis of the model context protocol specification and prompt in- jection vulnerabilities in tool-integrated llm agents","venue":null,"work_id":"1db9ca2d-eba6-4e2e-830a-47115aa4a474","year":2026},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:e2ea5b7d7957782d6b39b19492f22ea0e23897394ec6069ec1430480b531bed7","observation_id":"9afcc3eb-cb16-4c68-b5b4-e35793513a7b","resolution":{"observed_at":"2026-05-19T23:27:52.569716Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.20270","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-01T10:05:40.169267Z","title":"Impossiblebench: Measuring llms’ propensity of exploiting test cases","venue":null,"work_id":"125547a4-5cc7-46aa-9ae1-a0f3ee0bc41e","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:a0007a3a6bad8e91a0cad361f1ce7dc4194d10251d666292cf7f0fe3b2bcb66f","observation_id":"1d808a55-40c1-449e-abeb-6fc8fe68b410","resolution":{"observed_at":"2026-05-19T23:27:52.555873Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2507.06134","doi":"10.48550/arxiv.2507.06134","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Vijayvargiya, A","venue":"ArXiv.org","work_id":"7315530a-8de5-452c-9c59-6e0cc7436bf1","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:9df2300e8e91f7966b7a3e8c2b088b6e4ed73378da9c30d85adbb782ddc8ad2b","observation_id":"e884a4a1-0691-4954-89df-c374c085161c","resolution":{"observed_at":"2026-05-19T23:27:52.582830Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2505.21936","doi":"10.48550/arxiv.2505.21936","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Redteamcua: Realistic adversarial testing of computer-use agents in hybrid web-os environments","venue":"ArXiv.org","work_id":"6007ee3c-bd9a-474e-af66-0ae591445be6","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:5f663bc65554fed5bb0c3113bf46a5d767d5d7e3475f08b8cf35f7c8b4d5d458","observation_id":"dc2c3041-f898-4663-ab5f-ecbda63971a1","resolution":{"observed_at":"2026-05-19T23:27:52.509330Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2512.15163","doi":"10.48550/arxiv.2512.15163","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Mcp-safetybench: A benchmark for safety evaluation of large language models with real-world mcp servers","venue":"Open MIND","work_id":"5c449631-d613-478d-aff3-86e9a0d0e575","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:e4b75bcbaec0e315fab1b1e270511a4f6ec168f66148ec3a7f9a381a26ec884c","observation_id":"8bc899a1-8672-45ab-ac97-643fb7e14acd","resolution":{"observed_at":"2026-05-19T23:27:52.618593Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2509.24002","doi":"10.48550/arxiv.2509.24002","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Mcpmark: A benchmark for stress-testing realistic and comprehensive mcp use","venue":"ArXiv.org","work_id":"5b1fa0f7-d604-4d0f-85f2-a2e91356834d","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:29537bf00963fd7b842a63eba66d12a7c0952837acd396d3251c16299daed0f1","observation_id":"b34d59e1-633c-4807-8385-346f4f346af6","resolution":{"observed_at":"2026-05-19T23:27:52.295788Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.02609","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-03T11:58:06.220366Z","title":"Redcodeagent: Automatic red-teaming agent against diverse code agents","venue":null,"work_id":"387faa3b-2681-4a98-9555-968b8949227a","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:8bf97383c8761a42ad2a2abe54f30da98a5cc1f3146a462853f5bcee7ce3bc4b","observation_id":"c4da4341-e137-46bd-8579-f7bbfd3e9cc5","resolution":{"observed_at":"2026-05-19T23:27:52.279574Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.18131","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Bluecodeagent: A blue teaming agent enabled by automated red teaming for codegen ai","venue":null,"work_id":"0530aeef-4467-4472-bc39-9a9603efb884","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:525c80e4484f58a51916ba403189a1d3a85ace931d9c1f270d468ec8aa65e534","observation_id":"d0e23d28-498d-4a9e-89f2-8930fe8996a0","resolution":{"observed_at":"2026-05-19T23:27:52.589339Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.09024","last_updated":"2025-04-18T14:30:31Z","snapshot_observed_at":"2026-08-02T12:38:54.249632Z","submitted_at":"2024-10-11T17:39:22Z","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","version":3},"cited_work":{"arxiv_id":"2410.09024","doi":"10.48550/arxiv.2410.09024","metadata_source":"pith","pith_arxiv_id":"2410.09024","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","venue":"cs.LG","work_id":"788aad10-421f-48d7-886c-792665914606","year":2024},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2410.09024","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:7e119d8af7673164b1804778dd7abfa7847d969d7ef180ec044482fe3c95eba5","observation_id":"bbf9b19c-2b5a-4519-a5ce-d8e515cfb8e0","resolution":{"observed_at":"2026-05-19T23:27:52.374731Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06825","last_updated":"2023-10-10T17:54:58Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-10T17:54:58Z","title":"Mistral 7B","version":1},"cited_work":{"arxiv_id":"2310.06825","doi":"10.48550/arxiv.2310.06825","metadata_source":"pith","pith_arxiv_id":"2310.06825","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Mistral 7B","venue":"cs.CL","work_id":"eb5e1305-ad11-4875-ad8d-ad8b8f697599","year":2023},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2310.06825","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:e60fafe09f484cbbdd7d9920ef162fa0101a02465a78904bb22255d1a3c1d72f","observation_id":"d12efa7c-1108-42fb-9a5f-7ed9959d32e8","resolution":{"observed_at":"2026-05-19T23:27:52.562355Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-10T22:08:12.954417+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-10T22:08:12.954417+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.09388","last_updated":"2025-05-14T13:41:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-05-14T13:41:34Z","title":"Qwen3 Technical Report","version":1},"cited_work":{"arxiv_id":"2505.09388","doi":"10.1016/j.aiopen.2022.12","metadata_source":"pith","pith_arxiv_id":"2505.09388","snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"Qwen3 Technical Report","venue":"cs.CL","work_id":"25a4e30c-1232-48e7-9925-02fa12ba7c9e","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2505.09388","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:ba6789f849c60c7944774d02cc5bc078305dc86c1889438eb1c289ccc62aa4d7","observation_id":"baddb7e9-fe46-472c-bb43-f1efd6668c3c","resolution":{"observed_at":"2026-05-19T23:27:52.307058Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.10671","last_updated":"2024-09-10T13:25:53Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-07-15T12:35:42Z","title":"Qwen2 Technical Report","version":4},"cited_work":{"arxiv_id":"2407.10671","doi":"10.18653/v1/2024.naacl-long.246","metadata_source":"pith","pith_arxiv_id":"2407.10671","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Qwen2 Technical Report","venue":"cs.CL","work_id":"a1857881-ab9b-4b80-9b5f-9ae4b5c2566d","year":2024},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2407.10671","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:67682636e9cca257d4774e276f2e904f2a1962c9419964ac8e34a07de74e9e82","observation_id":"4597fe2c-74ce-4086-8ab5-1d9430571721","resolution":{"observed_at":"2026-05-19T23:27:52.485115Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2501.00656","last_updated":"2025-10-08T07:50:45Z","snapshot_observed_at":"2026-08-08T06:58:44.493777Z","submitted_at":"2024-12-31T21:55:10Z","title":"2 OLMo 2 Furious","version":3},"cited_work":{"arxiv_id":"2501.00656","doi":"10.48550/arxiv.2501.00656","metadata_source":"pith","pith_arxiv_id":"2501.00656","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"2 OLMo 2 Furious","venue":"cs.CL","work_id":"9ef0dc2b-fdfe-4f14-b235-ef7556dc709a","year":2024},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2501.00656","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:33f32953f1130a1a1cca2b7dfed7705ea4fc5c0e81188a4c559f03763393724c","observation_id":"e120a031-aa69-4e49-823c-63edaabde9fe","resolution":{"observed_at":"2026-05-19T23:27:52.473349Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-07-11T05:19:24.20254+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-11T05:19:24.20254+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-08-10T16:40:37.411115Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":"2407.21783","doi":"10.1016/s0749-0720(15","metadata_source":"pith","pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"The Llama 3 Herd of Models","venue":"cs.AI","work_id":"1549a635-88af-4ac1-acfe-51ae7bb53345","year":2024},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:6b41dcb81b037219a090863447210ecf1c1cb57eb115f1279cbffa310d9b7da1","observation_id":"113fdabe-15fa-402d-b958-56fe8c8ae020","resolution":{"observed_at":"2026-05-19T23:27:52.315839Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.02387","doi":"10.48550/arxiv.2510.02387","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Cwm: An open-weights llm for research on code generation with world models","venue":"ArXiv.org","work_id":"7a74903a-6383-48ce-97b8-17afa5faeae1","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:b82bbc2445b626d16e58c37f0b839d4688689a1af9059aee18c30bbd1f14566a","observation_id":"ab64cf79-a2b9-4294-b1c7-94c2086bfbec","resolution":{"observed_at":"2026-05-19T23:27:52.422287Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.28166","last_updated":"2026-04-20T07:37:21Z","snapshot_observed_at":"2026-08-11T10:43:54.775522Z","submitted_at":"2026-03-30T08:35:00Z","title":"Evaluating Privilege Usage of Agents with Real-World Tools","version":2},"cited_work":{"arxiv_id":"2603.28166","doi":null,"metadata_source":"pith","pith_arxiv_id":"2603.28166","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Evaluating Privilege Usage of Agents with Real-World Tools","venue":"cs.CR","work_id":"846ef222-b04f-4285-a9e3-3f81eaa73cb3","year":2026},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2603.28166","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:a39e4df7ebc566fc956e0623316f904e9bf04c9480f3cc8c16420b75b508af9a","observation_id":"8ac61058-bdd4-46c4-8c69-0cf78a278a75","resolution":{"observed_at":"2026-05-19T23:27:52.450166Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.14281","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Mcpshield: A security cognition layer for adaptive trust calibration in model context protocol agents","venue":null,"work_id":"0ea07299-8766-4457-8267-b6b9dab6e88b","year":2026},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:ccedbb3958b0db276baed216c7ea75e21abaa5aef0b0bbb8fe53f783534ca993","observation_id":"ab467022-1356-45bb-a775-279454e2d493","resolution":{"observed_at":"2026-05-19T23:27:52.411639Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-09T00:25:49.321663Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents","venue":null,"work_id":"f2177339-1d1d-45d8-bb16-63b023bf2690","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:343041959bfa32c983e729c37ce6a58f1adfc534342385bc6766ab8bbbd18d27","observation_id":"485a45cd-f748-422b-ad6a-993cf9f4f59f","resolution":{"observed_at":"2026-05-19T23:27:53.244909Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-07T19:59:01.081751Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:1b1ba66c8e46ded698d8e7c36a67f9c2a9d936d9b0ea34cdd44ff72e2cbbbad7","observation_id":"47acb930-00d5-4610-b6f8-40b5bd42ced8","resolution":{"observed_at":"2026-05-19T23:27:52.462500Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2601.10156","doi":"10.48550/arxiv.2601.10156","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Toolsafe: Enhancing tool invocation safety of llm-based agents via proactive step-level guardrail and feedback","venue":"arXiv (Cornell University)","work_id":"269ce88a-7462-4243-915f-bb464194900f","year":2026},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:8471b244c1d17970594b54ad19d774c287fcfa2c7c3d388b6315fe5d8dcc3f9c","observation_id":"2db7019a-4e71-4607-87ba-bd12422f5275","resolution":{"observed_at":"2026-05-19T23:27:52.438570Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2602.13379","last_updated":"2026-06-10T21:28:47Z","snapshot_observed_at":"2026-08-08T14:12:41.932086Z","submitted_at":"2026-02-13T18:38:18Z","title":"Unsafer in Many Turns: Benchmarking and Defending Multi-Turn Safety Risks in Tool-Using Agents","version":2},"cited_work":{"arxiv_id":"2602.13379","doi":"10.48550/arxiv.2602.13379","metadata_source":"pith","pith_arxiv_id":"2602.13379","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Unsafer in many turns: Benchmarking and defending multi-turn safety risks in tool-using agents","venue":"cs.CR","work_id":"23cffd44-840b-4aca-827b-efc3ed0ec254","year":2026},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2602.13379","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:234f62276dd0df90f6fb831f756b2de0e4313f86225288bf56705f8d51fbd2f3","observation_id":"2605665c-f537-4653-8067-666bff20e950","resolution":{"observed_at":"2026-06-12T02:08:25.633841Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.22724","doi":"10.48550/arxiv.2602.22724","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Agentsentry: Mitigating indirect prompt injection in llm agents via temporal causal diagnostics and context purification","venue":"Open MIND","work_id":"f201b9d8-52ac-4a3f-888c-e488c65bc313","year":2026},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:2dc3d2ac221fb584391e03f7a5248e8560f661494cf262ffef0052bdce596903","observation_id":"c750350c-d39e-4407-b490-a5cb9c00f92b","resolution":{"observed_at":"2026-05-19T23:27:52.290598Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.08829","doi":"10.48550/arxiv.2510.08829","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Commandsans: Securing ai agents with surgical precision prompt sanitization","venue":"ArXiv.org","work_id":"9843f4ed-cf37-44c6-8f16-bed06d3a5c25","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:76070f07802d311aa1b550baf6fef3362505e858fcec38f2550903f4a90a6a69","observation_id":"4f2b9ce9-fa27-4d44-a7ac-6625eb5e5805","resolution":{"observed_at":"2026-05-19T23:27:52.348681Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.01194","last_updated":"2026-07-25T19:27:27Z","snapshot_observed_at":"2026-08-07T18:02:22.537986Z","submitted_at":"2026-04-01T17:40:03Z","title":"AgentWatcher: A Rule-based Prompt Injection Monitor","version":2},"cited_work":{"arxiv_id":"2604.01194","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2604.01194","snapshot_observed_at":"2026-07-28T02:22:29.738998Z","title":"Agentwatcher: A rule-based prompt injection monitor","venue":null,"work_id":"fb3f0f4d-6e7d-49df-9ae0-283ae0429309","year":2026},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2604.01194","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:f3f68f587853d91a6ea38cba132c43f40e412d3515b91d3b795ac6e26c14e211","observation_id":"49b01948-34e7-4e35-aa04-69b3806416b6","resolution":{"observed_at":"2026-07-28T02:22:29.738998Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.07398","doi":"10.48550/arxiv.2602.07398","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Agentsys: Secure and dynamic llm agents through explicit hierarchical memory management","venue":"Open MIND","work_id":"b2a07171-df6e-496e-a883-60d2bd0f4dad","year":2026},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:e01753ad67d2858e87860cc98ce83432aadb0cf3b5ed9d7f215ca4e1cb6a325f","observation_id":"b47adc32-c21f-42ba-974b-b6c0116eaa03","resolution":{"observed_at":"2026-05-19T23:27:52.300973Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2511.20597","last_updated":"2026-08-12T00:08:22Z","snapshot_observed_at":"2026-08-13T13:28:32.409956Z","submitted_at":"2025-11-25T18:28:35Z","title":"BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents","version":2},"cited_work":{"arxiv_id":"2511.20597","doi":"10.48550/arxiv.2511.20597","metadata_source":"arxiv_reference","pith_arxiv_id":"2511.20597","snapshot_observed_at":"2026-08-13T01:24:45.972029Z","title":"Browsesafe: Understanding and preventing prompt injection within ai browser agents","venue":"ArXiv.org","work_id":"a0d67379-2d33-454a-adc9-f11a80f22f99","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2511.20597","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:a9a906340983f6478f48ae1ca3834709122c2634f10b88065c4f1ad9ab58de21","observation_id":"6a8e7267-cf47-44be-b914-0f8d010ee7d7","resolution":{"observed_at":"2026-08-13T01:24:45.972029Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.03205","last_updated":"2026-06-03T04:25:24Z","snapshot_observed_at":"2026-08-10T08:23:16.276882Z","submitted_at":"2026-03-03T17:59:35Z","title":"Learning When to Act or Refuse: Guarding Agentic Reasoning Models for Safe Multi-Step Tool Use","version":2},"cited_work":{"arxiv_id":"2603.03205","doi":null,"metadata_source":"pith","pith_arxiv_id":"2603.03205","snapshot_observed_at":"2026-07-03T16:58:43.698040Z","title":"Learning when to act or refuse: Guarding agentic reasoning models for safe multi-step tool use","venue":"cs.CL","work_id":"38d4c3be-524b-42c7-b339-3f35c6cb9fb0","year":2026},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2603.03205","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:ebf6834ea9772bd3835aef370f99c5fce015a2f7e0f5248d15a8680986036e16","observation_id":"395601be-1313-4331-a841-dddd7408b4f5","resolution":{"observed_at":"2026-06-04T02:07:11.549850Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.30016","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-30T13:54:43.856434Z","title":"Edward Suh","venue":null,"work_id":"2db00f72-d426-4199-ace5-5288fb3232bc","year":2026},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:484403f41725d1f4fe9759c9b62fee23c137d8f8c29e088d70a01bd5219cf58d","observation_id":"e99f00df-581c-48a3-ad27-c9efc5fd36cf","resolution":{"observed_at":"2026-05-19T23:27:52.284887Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.22928","last_updated":"2026-08-11T08:45:07Z","snapshot_observed_at":"2026-08-13T13:25:44.927045Z","submitted_at":"2026-03-24T08:21:51Z","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","version":2},"cited_work":{"arxiv_id":"2603.22928","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2603.22928","snapshot_observed_at":"2026-08-12T02:24:10.274858Z","title":"Sok: The attack surface of agentic ai–tools, and autonomy","venue":null,"work_id":"c185362d-a226-40fa-a8d2-fc48331ef5bf","year":2026},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2603.22928","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:40acd954b4e8f78e7ffbc72096de9d3d1afbbf2b17bf9bd83c3b175412a2950b","observation_id":"3ca4c3cd-6b4d-45fd-94ef-b44b234b9aba","resolution":{"observed_at":"2026-08-12T02:24:10.274858Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Reason- ing with language model is planning with world model","venue":null,"work_id":"6ab408b0-2b5e-41d8-8dc4-48a9d90b59c6","year":2023},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:4ed30615d7fe2892894ff6aaa32ebf338e3b65702ad318a28cf1eb691f0bd2de","observation_id":"9138402e-3948-4430-ae39-5ed1ba241556","resolution":{"observed_at":"2026-05-19T23:27:53.239852Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"0cbcd737-d09d-41fb-8596-c808d3c15aeb","year":2023},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:8214427e64f08c98908601f75a352470f5231db1d050012358ba25e9197f3101","observation_id":"9eaed837-5b33-4ae1-8118-a0190b221603","resolution":{"observed_at":"2026-05-19T23:27:53.255357Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Generating code world models with large language models guided by monte carlo tree search.Advances in Neural Information Processing Systems, 37:60429–60474","venue":null,"work_id":"189a7594-7d3f-4152-ad6b-00edd24cc6e9","year":2024},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:f159a310014ca337b4f8797659ffe39e9d6d8461bbb79fdc4764d45378084366","observation_id":"172cedb8-1493-4c07-8a6b-a566e4530e00","resolution":{"observed_at":"2026-05-19T23:27:53.264280Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"f6de236c-acf2-4835-842c-6686a511a094","year":null},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:bb0fdcaf0ec7ca6d7fff1d40d0633a0061f5870662fe9f57cc7feee7998448d7","observation_id":"a9d17490-85cc-405b-90f8-5ee468dc51da","resolution":{"observed_at":"2026-05-19T23:27:53.230454Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"e14d4aff-bdba-4bc5-9c91-666233d41ee2","year":null},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:8001c46713495d980d194bb156668f52fb85a5fdf205798e60f9fca2eb1a8e06","observation_id":"cf620e62-8db7-44e6-84bc-7899961a0847","resolution":{"observed_at":"2026-05-19T23:27:53.222440Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"66955543-b04e-437a-89e2-372749ff556c","year":null},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:0557beb25d9cdef9b2e5b733a2b2e8572f2b496cfbe50178853e5305ffb7c031","observation_id":"cf33150b-eabe-4ae3-9bf6-0b4104266d9d","resolution":{"observed_at":"2026-05-19T23:27:53.213645Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Candidate episodes produced by this process are retained only after a two-person audit","venue":null,"work_id":"2576f055-4cf0-4a14-8421-c638367fd920","year":null},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:578f645d5806fd9e3dd3a212d481884b203e63fda361fe5f0c411ef0ee4bb87e","observation_id":"655e397f-3065-4b06-9f66-7f5b34b3c842","resolution":{"observed_at":"2026-05-19T23:27:53.218048Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"ff262a08-4646-413f-ae70-a000ba4ba7d0","year":null},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:b4996efadfa682d9b0066bf717a86a600ac37cc72f2864a1bfb82b78fc35282b","observation_id":"520986dc-8774-4187-bd44-2564d5667bda","resolution":{"observed_at":"2026-05-19T23:27:53.207495Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"trajectory_digest","venue":null,"work_id":"2c774fbe-2c59-424c-8334-24180c301f0b","year":null},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:7c14760b80f3ab6bab2adc44be8e80c6e2faab29a708753f389559fe0a5f167e","observation_id":"0e819038-85c6-4445-b77e-500192575604","resolution":{"observed_at":"2026-05-19T23:27:53.226462Z","resolver_source":"raw_fallback","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback"},"reference_resolution":{"displayed":50,"state_counts":{"malformed_identifier":1,"metadata_mismatch":2,"parse_uncertain":0,"unresolved":5,"verified_exact":32,"verified_fuzzy":10},"total_outbound_references":50},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"thesis":"As of 13 August 2026, this Paper Citation Record lists 50 of 50 outbound references and 0 inbound Pith citation observations for arXiv:2605.17453."}