{"as_of":"2026-08-07T10:31:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:a0de5586b5ebe576bd29f8adbd037241f259c40332fe0be532fa073437b25d17","coverage":[{"denominator":78,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":78,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-21T07:43:14.250188Z","state":"measured"},{"denominator":79,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":79,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-07T06:34:17.273281+00:00","state":"measured"},{"denominator":1,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":1,"source":"paper_references, paper_reference_links","source_observed_at":"2026-06-26T08:03:48.140937Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-07-04T11:19:50.227826Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"cited_work":{"arxiv_id":"2605.18991","doi":null,"metadata_source":"pith","pith_arxiv_id":"2605.18991","snapshot_observed_at":"2026-07-04T11:19:50.227826Z","title":"Agent Security is a Systems Problem","venue":"cs.CR","work_id":"e0e4d889-916d-4422-85a7-3bda12590cac","year":2026},"citing_paper":{"arxiv_id":"2606.23138","last_updated":"2026-06-22T10:31:53Z","snapshot_observed_at":"2026-07-06T23:57:57.606047Z","submitted_at":"2026-06-22T10:31:53Z","title":"Rising From the Ashes: How Agentic AI is Unblocking Challenges in Cybersecurity","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-06-26T08:03:48.140937Z"},"links":{"cited_paper":"/paper/2605.18991","citing_paper":"/paper/2606.23138"},"observation_digest":"sha256:aa814929d217c1d90426996739468cd73e3790abccbed0dd76b5d0319f9836c8","observation_id":"f4ce874e-9c8b-4b7f-8d44-dcc2ca639f82","resolution":{"observed_at":"2026-07-04T11:19:50.229266Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2605.18991/citation-record","integrity":"/paper/2605.18991/integrity","json":"/paper/2605.18991/citation-record.json","paper":"/paper/2605.18991"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"AWS Identity and Access Management (IAM).https://aws.amazon.com/iam/","venue":null,"work_id":"6347c22f-b481-48fe-856e-951bcaf2c75a","year":2026},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:ca4fea290219c9acc6c44ae4e8ddc121e2c4045bc4f02e061a81c928ce3eb30b","observation_id":"c7c00658-3fac-4e49-8535-36e253583e45","resolution":{"observed_at":"2026-05-21T07:44:03.378674Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Agent skills—Claude API docs","venue":null,"work_id":"fdd302d0-bae5-46c8-817e-e1da9c2ac3b6","year":2026},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:f0f65ae370fb9371beed2a9650e2d7267bce421665507680443ff320b293dacf","observation_id":"7cccb02b-fec1-4b76-b5d3-0214b1b02b2d","resolution":{"observed_at":"2026-05-21T07:44:03.385836Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Next-generation constitutional classifiers: More efficient protection against universal jailbreaks","venue":null,"work_id":"3444544a-f0d5-420f-a216-209153ea42b0","year":2026},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:59b33c43f8c4d731657e2128852ed0915a71eadea6b49a1dfdef360d86eaf5ef","observation_id":"5e930f18-5635-4431-9e05-69c3c330d28b","resolution":{"observed_at":"2026-05-21T07:44:03.367387Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Poisoning fine-tuning datasets of constitutional classifiers.https://alignment.anthropic.com/2026/ backdooring-classifiers/, April 2026","venue":null,"work_id":"15632b12-6bac-4c95-8c67-468529a0e21a","year":2026},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:b085e158a6f7f417941a76c2148a4ea4ece1c0668f3a8f39298e80c323a9f6a0","observation_id":"a81e8bf0-5ed9-4fa6-ac73-a20c441d34e1","resolution":{"observed_at":"2026-05-21T07:44:03.369804Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1802.00420","last_updated":"2018-07-31T00:09:56Z","snapshot_observed_at":"2026-07-06T06:21:22.353187Z","submitted_at":"2018-02-01T18:20:05Z","title":"Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples","version":4},"cited_work":{"arxiv_id":"1802.00420","doi":"10.48550/arxiv.1802.00420","metadata_source":"pith","pith_arxiv_id":"1802.00420","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples","venue":"cs.LG","work_id":"ba6fa529-61c0-4558-b9a7-78eb3e5f901d","year":2018},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/1802.00420","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:6bec7f0069ba7ebdf005e45cb39d861b806f3d15734b8544c93aff5b465c2287","observation_id":"2c4b5889-4ecd-4e64-8655-4e046e1a24ee","resolution":{"observed_at":"2026-05-21T07:44:02.897958Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Information flows in causal networks.Advances in complex systems, 11(01):17–41","venue":null,"work_id":"8aecf596-424c-494e-b9a8-83f3ff90ce37","year":2008},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:aa5b552d8d01d4110f2587a11cd7ac0d124f8dda8bda2518e4d030529bbc9a83","observation_id":"90908b59-6171-4deb-9837-9032c7f693ae","resolution":{"observed_at":"2026-05-21T07:44:03.374912Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Introducing Guardrails: The Contextual Security Layer for the Agentic Era.https://invariantlabs.ai/blog/ guardrails, April 2025","venue":null,"work_id":"54665977-7557-47b5-8a8f-d4ce130c0610","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:3245542b1f543a1bf4b00e6742fc3b78a009037ae6a2bc8378867007e1b748c2","observation_id":"cdd60bf2-9127-4e9f-b928-44f1b20d2ccf","resolution":{"observed_at":"2026-05-21T07:44:03.362009Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"StruQ: Defending against prompt injection with structured queries","venue":null,"work_id":"0b116e13-c4bc-4dd1-9f54-b0c62801e063","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:e0f2039033ed8422a984c9a05b36bcdae774c9c1134fdebc8245d6580c9d3a5c","observation_id":"c45ca4be-1ec1-461a-b984-227bc86d9cea","resolution":{"observed_at":"2026-05-21T07:44:03.391148Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2507.07974","last_updated":"2025-08-25T16:49:10Z","snapshot_observed_at":"2026-08-06T18:25:32.971973Z","submitted_at":"2025-07-10T17:51:05Z","title":"Defending Against Prompt Injection With a Few DefensiveTokens","version":2},"cited_work":{"arxiv_id":"2507.07974","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2507.07974","snapshot_observed_at":"2026-07-04T00:59:20.691622Z","title":"Defending against prompt injection with a few defensive tokens","venue":null,"work_id":"4f729650-c7f8-4e91-b5ed-4250fe884098","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2507.07974","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:a7b6892979e998da7123e3447ccae818768d620a56f40ea2f0a7ff9a6a8c353d","observation_id":"600205e2-4a6b-4577-b4a7-3841a0de1d52","resolution":{"observed_at":"2026-05-21T07:44:02.915798Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"SecAlign: Defending Against Prompt Injection with Preference Optimization","venue":null,"work_id":"5d80e0a1-f9de-4ba8-83c3-e84d7c882c74","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:0b121baf6125e1f8fabb6dcd65f80e2e710e63d7941441d7c04d31dd0a79d9da","observation_id":"4489fc60-5f4e-4484-9e37-99d8581c5665","resolution":{"observed_at":"2026-05-21T07:44:03.387567Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2507.02735","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:58.857965Z","title":"Meta secalign: A secure foundation llm against prompt injection attacks","venue":null,"work_id":"69776aad-e4d1-4d24-bb01-59055547fa49","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:ec6c8a1a4d4f4ea08a52870817cd3a0d83c0c2cc5acc930bdb184c068e739279","observation_id":"92ee5512-0fa4-4879-9380-12eefd86c9c5","resolution":{"observed_at":"2026-05-21T07:44:02.907676Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning","venue":null,"work_id":"30985abe-053d-4797-bbe4-183aa50153c5","year":null},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:11c13e41be93d43a1d95354e88e1f36766ccc6f327c3e36fa243cff4c6b5b806","observation_id":"ba30d816-53a4-4a7a-8321-2bd5359eb6be","resolution":{"observed_at":"2026-05-21T07:44:03.382183Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2503.22738","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T00:29:16.330261Z","title":"arXiv preprint arXiv:2503.22738 , year=","venue":null,"work_id":"d6d755e8-beb8-4208-aea4-da7adbea2446","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:c8ee9848881e2909bb1ed606d5dfd44ec28f277f57b53d60303cd4adad486714","observation_id":"d5f8c5c3-b3ad-4de7-859d-0cfa2cd2e065","resolution":{"observed_at":"2026-05-21T07:44:02.905167Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"How Not to Detect Prompt Injections with an LLM","venue":null,"work_id":"b40b531e-3a99-4076-8dc1-d5d0029d6995","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:1c9cd6653faa0ffdc4203d7900ee3ce65b59253fb49775ea4b1c16e64f81dc1b","observation_id":"05bd67c5-0766-430b-8530-d5eb2fe0c96e","resolution":{"observed_at":"2026-05-21T07:44:03.381796Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.23643","last_updated":"2025-09-03T12:30:47Z","snapshot_observed_at":"2026-07-06T21:33:02.686798Z","submitted_at":"2025-05-29T16:50:41Z","title":"Securing AI Agents with Information-Flow Control","version":2},"cited_work":{"arxiv_id":"2505.23643","doi":"10.48550/arxiv.2505.23643","metadata_source":"pith","pith_arxiv_id":"2505.23643","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Securing AI Agents with Information-Flow Control","venue":"cs.CR","work_id":"58ee5225-7de4-4e38-b970-5afd29ddd925","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2505.23643","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:767655ffea5e428636abc9f756abbd42a682bfea84f7bba31b616780cfa4db7c","observation_id":"aaa6420d-7a50-4a2c-81f3-e1be8d1c533d","resolution":{"observed_at":"2026-05-21T07:44:02.908148Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1145/3649835","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Cutler, Craig Disselkoen, Aaron Eline, Shaobo He, Kyle Headley, Michael Hicks, Kesha Hietala, Eleftherios Ioannidis, John H","venue":"Proceedings of the ACM on Programming Languages","work_id":"989cfdbe-580e-4cd4-819f-509f4528a3ef","year":2024},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:47d930252e21ed3fe3851327f189397ea2f952cecb8f1fce7a28c8b374177871","observation_id":"889ea9b6-18d7-4bcf-afa9-b5fc09377db7","resolution":{"observed_at":"2026-05-21T07:44:02.472177Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Algorithmic transparency via quantitative input influence: Theory and experiments with learning systems","venue":null,"work_id":"8db0121a-ad3c-4fa2-9f3c-bd42204f66b0","year":2016},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:2d6c838d2942140165949b8e6c8d4181e587cd5320b83a40392fc06f36f226fe","observation_id":"faa56cf5-4245-4b7f-91dc-5012f6561d6e","resolution":{"observed_at":"2026-05-21T07:44:03.390831Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-06T07:36:52.841128Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:d694be8dc0c61202b54fdc1ee6f56484b6b60bc240956f0a8b41a82000813caf","observation_id":"47089b14-e6e7-4a34-994f-36c50ea98e00","resolution":{"observed_at":"2026-05-21T07:44:02.910333Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"0051.360056","doi":"10.1145/360051.360056","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"A lattice model of secure information flow","venue":"Communications of the ACM","work_id":"6cdbea4c-88e9-4d05-a58e-c82a89b4d66b","year":1976},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:9a8bc884caa55d2d8ccaa5d79808d35218adbbc6c1a3f9df9ea14d4fe8a1fe19","observation_id":"545ff882-ec11-4432-ae86-87bc8558863c","resolution":{"observed_at":"2026-05-21T07:44:02.475036Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-07-11T23:19:19.89537+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-11T23:19:19.89537+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Binder, a Logic-based Security Language","venue":null,"work_id":"9951282b-bca1-4e35-8805-ecd2b4d59e26","year":2002},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:29b014dbd14918eac5d2f4a2c0a1c5c241a7a8241d2227404c6cf8f75b8ea2bf","observation_id":"3028ac84-e44a-46d5-b036-a8e1ab2e0d47","resolution":{"observed_at":"2026-05-21T07:44:03.371446Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1145/2619091","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N","venue":"ACM Transactions on Computer Systems","work_id":"57e4fd22-a95f-4d99-b2e9-fff6cd5160b6","year":2014},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:2f6b44eb203535b888896ac677d553cfd2bc06c1f5d5f047a7528e08fa328ea2","observation_id":"6ff3d76b-a0f5-4e76-839c-8a2ed50cde8d","resolution":{"observed_at":"2026-05-21T07:44:02.468777Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Causal abstractions of neural networks.Advances in neural information processing systems, 34:9574–9586","venue":null,"work_id":"bdff419a-6d02-4648-8167-ff84746236b8","year":2021},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:9413b4b59fe7ea638544839747fb5b2a5c2418548ba00cf3945fa26ba6cdfbbe","observation_id":"3ee89bc7-12ab-433a-a3c0-18ce15ae4ff8","resolution":{"observed_at":"2026-05-21T07:44:03.371187Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"CAPSEM: Contextual Agent Privacy and Security Manager.https://capsem.org/","venue":null,"work_id":"4ac4dd68-a061-4fe6-bcef-e99b1b3fe458","year":2026},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:c9a65e5a21ad39453673ffbd8f3cf204ce490ebcf7cc560fd1edf4e4a3a861c5","observation_id":"500fd4c8-008f-4d22-b469-cbe36a4ad5ce","resolution":{"observed_at":"2026-05-21T07:44:03.376864Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Identity and Access Management (IAM).https://cloud.google.com/iam/","venue":null,"work_id":"ca76d6df-35b1-453f-9ae3-004d3969bab4","year":2026},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:1a1be750af9dfe7afc454834a082d4019392d2e1057d3ad80fbefd728687b738","observation_id":"1b92ca6c-76be-4877-8048-61a8df14ded8","resolution":{"observed_at":"2026-05-21T07:44:03.358321Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Not what You’ve Signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","venue":null,"work_id":"8311fa69-8a3c-4f03-be09-0760b9bf520e","year":null},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:f8da31378d05859630121445a91a0a55007fadef53d7abf9879f5531947eb30b","observation_id":"dec5e04d-bbf7-4601-9bfb-28c4793ad8b0","resolution":{"observed_at":"2026-05-21T07:44:03.360150Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2302.12173","last_updated":"2023-05-05T14:26:17Z","snapshot_observed_at":"2026-07-06T14:55:08.682906Z","submitted_at":"2023-02-23T17:14:38Z","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","version":2},"cited_work":{"arxiv_id":"2302.12173","doi":"10.1109/sp61157.2025.00250","metadata_source":"pith","pith_arxiv_id":"2302.12173","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","venue":"cs.CR","work_id":"7a8cfce1-ada7-4a7a-8516-6f16b1bd077b","year":2023},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2302.12173","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:355c150f4716166f2ae494b6f53a465a50c06df2f52ae444dfb441d28edc345a","observation_id":"f92f1157-2a68-46bd-8f0e-8ea5acde25a9","resolution":{"observed_at":"2026-05-21T07:44:02.895835Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Quantifying causal influences","venue":null,"work_id":"052164e0-9aad-47fd-bfb2-adb2eb7fd3b6","year":2013},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:3445c3e9ece04ad952df068c3bc84498d52138b641ad813ccd51bdde08c08492","observation_id":"f95cc9bf-01df-453a-8747-a762fe3078d6","resolution":{"observed_at":"2026-05-21T07:44:03.353803Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"A critical evaluation of defenses against prompt injection attacks","venue":null,"work_id":"a000d310-c63a-4847-91bb-c9092c309709","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:d702e44d2cc903b040238fcaef654f99fd9fb41a89a84e8ccacaaaa975111871","observation_id":"c23d812e-7665-4fcf-8f21-ccdb87dea708","resolution":{"observed_at":"2026-05-21T07:44:03.359740Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2507.14799","last_updated":"2025-07-20T03:10:13Z","snapshot_observed_at":"2026-08-06T23:52:08.348122Z","submitted_at":"2025-07-20T03:10:13Z","title":"Manipulating LLM Web Agents with Indirect Prompt Injection Attack via HTML Accessibility Tree","version":1},"cited_work":{"arxiv_id":"2507.14799","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2507.14799","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"InConference on Empirical Methods in Natural Language Processing","venue":null,"work_id":"8ce63ef2-5ec3-40e0-9326-371c4d950cf6","year":2024},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2507.14799","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:e8b8cf1ed015d335b64141ef87346f2b37b39c24692ccac56829cc776a226a2c","observation_id":"79133e4d-fb4c-4213-be4f-53769c1fa681","resolution":{"observed_at":"2026-05-21T07:44:02.899096Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Optimizing agent planning for security and autonomy","venue":null,"work_id":"b1243d23-60e7-4947-9c8f-3e9fdb8d45c9","year":2026},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:b640213d21cf5b5b695c0120c9266b894f3569c6f31ce5231e04927707895e8b","observation_id":"ea9aba54-67d5-42d4-b56f-4d39a66e60a8","resolution":{"observed_at":"2026-05-21T07:44:03.363611Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"ACE: A Security Architecture for LLM-Integrated App Systems","venue":null,"work_id":"86613965-4ce1-418c-aace-1db427c33fc1","year":2026},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:f9dbdbd465d3b359a4134ea2c8b434d18488775164c990d1a92627aa3ab60bb7","observation_id":"62777396-33b9-44dd-9ef0-2dbbd3ad9f61","resolution":{"observed_at":"2026-05-21T07:44:03.348779Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"1157.2025","doi":"10.1109/sp61157.2025","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"In: IEEE Symposium on Security and Privacy (S&P)","venue":null,"work_id":"a0c5de2d-efac-48fc-b13a-974e47947668","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:cd91079c99795c6e7dbd4b4b589b4f91ec44e2408b7c001f5d38adc5cd199499","observation_id":"898e5be1-e2c9-4ec8-aaeb-5434084c3e69","resolution":{"observed_at":"2026-05-21T07:44:02.471908Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-07-13T11:50:05.157437+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-13T11:50:05.157437+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.15911","last_updated":"2024-02-24T21:27:13Z","snapshot_observed_at":"2026-07-06T17:35:01.907906Z","submitted_at":"2024-02-24T21:27:13Z","title":"PRP: Propagating Universal Perturbations to Attack Large Language Model Guard-Rails","version":1},"cited_work":{"arxiv_id":"2402.15911","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2402.15911","snapshot_observed_at":"2026-07-03T00:27:29.198098Z","title":"Prp: Propagating universal perturbations to attack large language model guard-rails","venue":null,"work_id":"fce49e9d-e649-4c8d-baa6-64c018f5a4a4","year":2024},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2402.15911","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:ffb2368975c046f7dd2f8684289ce3901b6eafb3958ce40eed7b250329a2cdb1","observation_id":"7a9a73d9-29d0-4f53-bfb5-d8480f1248f7","resolution":{"observed_at":"2026-05-21T07:44:02.881062Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"ceLLMate: Sandboxing Browser AI Agents","venue":null,"work_id":"2d4af20a-9036-40dd-8f98-d8019712ac41","year":null},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:d58455be000e5ef413a21dbf9acb5b7e9837143348f76473fb7a82a0c8522790","observation_id":"fc5a4e01-e2d4-4b85-ab3f-1d8351ae1663","resolution":{"observed_at":"2026-05-21T07:44:03.350266Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2512.12594","doi":"10.48550/arxiv.2512.12594","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"cellmate: Sandboxing browser ai agents","venue":"arXiv (Cornell University)","work_id":"3994ee1f-f65b-4f8b-93e9-6ec20a5e0988","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:d05d07187e736c38dcbbe6575d22c68f6d1ed1e0452378d2ee212b58176bbde9","observation_id":"7d9ab52a-ec60-4426-ba59-686c49f289af","resolution":{"observed_at":"2026-05-21T07:44:02.884203Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Azure Policy Documentation.https://learn.microsoft.com/en-us/azure/governance/policy/","venue":null,"work_id":"267f7f27-b4ff-4583-aef3-230a2d0cca3c","year":2026},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:09af1756855e5e08fa37dad19056e78c26e704583bb69ed797e3f6bf7fe55b74","observation_id":"92e916e0-c9fe-4f8b-b8aa-55f9b31addfc","resolution":{"observed_at":"2026-05-21T07:44:03.373115Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.05156","doi":"10.48550/arxiv.2510.05156","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"VeriGuard: enhancing LLM agent safety via verified code generation","venue":"ArXiv.org","work_id":"2dd53484-c7be-4195-a808-1d121845c686","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:aa520ae9b462ed60f25ddc2d8c09f9b6cb35375119d4b0abb1004700702f443a","observation_id":"136737c5-2b2a-4cb8-acf4-fcc1f7deaee9","resolution":{"observed_at":"2026-05-21T07:44:02.879144Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-03T00:38:10.103868+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-03T00:38:10.103868+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Measuring information leakage using generalized gain functions","venue":null,"work_id":"a481c012-e160-4af0-b6be-ae69221c7678","year":2012},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:58264f6254e367f25ce3ad8108319f7d34ec5631f34cd0013547651695e330cf","observation_id":"35f96165-4709-467f-9659-06062c1dc3ac","resolution":{"observed_at":"2026-05-21T07:44:03.337972Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.09023","last_updated":"2025-10-10T05:51:04Z","snapshot_observed_at":"2026-08-03T03:11:42.084785Z","submitted_at":"2025-10-10T05:51:04Z","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","version":1},"cited_work":{"arxiv_id":"2510.09023","doi":"10.48550/arxiv.2510.09023","metadata_source":"pith","pith_arxiv_id":"2510.09023","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","venue":"cs.LG","work_id":"585d66b7-a25c-4390-a7c8-8b15064c122f","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2510.09023","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:5d6650327bd3aad9c7bedbc103c81b4e992de806bce5eef5cfc41fd7a8a3162e","observation_id":"32486bf0-c6fc-4ce8-b0f8-e5bc9a0926c8","resolution":{"observed_at":"2026-05-21T07:44:02.885247Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Automatically hardening web applications using precise tainting","venue":null,"work_id":"c793d8f2-6369-49e6-a542-eb9a2e541bfa","year":2005},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:66894d78a168e2965f9a7dca0af0575f49fcf851e6e84a248f17618fe9d53cb6","observation_id":"6c448298-782c-40b4-82cf-8e1dee02b3d2","resolution":{"observed_at":"2026-05-21T07:44:03.332415Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails","venue":null,"work_id":"33e6a74c-3e89-4f93-a977-29d456638d6b","year":2023},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:eabb3e0d1ead73f7811ca09cb71a29f05705ae0a352175ab2476ddc0a9d5d89f","observation_id":"22c63825-9b8a-45d1-a19c-0af95b4d2b49","resolution":{"observed_at":"2026-05-21T07:44:03.331171Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"ClawHub, the skill dock for sharp agents","venue":null,"work_id":"23a92654-39e1-4ca1-a3b8-6fee2d82b5c0","year":2026},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:a2d57273dde9c8036f1200f5ec64bc8ad8cf3f9dfdb1d7a9b699092c76f010be","observation_id":"a0a33788-bc67-4f86-a1ea-29cbd217cc55","resolution":{"observed_at":"2026-05-21T07:44:03.356095Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2602.16708","last_updated":"2026-05-08T15:45:27Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2026-02-18T18:57:12Z","title":"Formal Policy Enforcement for Real-World Agentic Systems","version":3},"cited_work":{"arxiv_id":"2602.16708","doi":null,"metadata_source":"pith","pith_arxiv_id":"2602.16708","snapshot_observed_at":"2026-07-11T02:47:51.036183Z","title":"Formal Policy Enforcement for Real-World Agentic Systems","venue":"cs.CR","work_id":"dc0c6fb4-ef13-485c-8109-a5a138684d7e","year":2026},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2602.16708","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:8f8b965be65699e05d455f958dbcff472184de4524120e47a202ea21fabdc636","observation_id":"ba88d5ed-78d3-430b-9628-ce7e99136d03","resolution":{"observed_at":"2026-05-21T07:44:02.912940Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Validating mechanistic interpretations: An axiomatic approach","venue":null,"work_id":"823bf8bd-6176-42ea-83b5-94edfbfa94a0","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:71bc2c8a84a2c7d7ef147d017e7f89d5b42d31ecf21f3479aa66c6bec41b42df","observation_id":"1ec7edb6-6064-4a5c-bfe4-fcd7c5382e16","resolution":{"observed_at":"2026-05-21T07:44:03.334303Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2507.07417","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T13:39:51.357615Z","title":"Pandya, Andrey Labunets, Sicun Gao, and Earlence Fernandes","venue":null,"work_id":"8fd877bd-d4d6-470c-92cc-df0265a6e4b7","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:8ad481a1226b5e40aa2a15c1311921c0ebaae8f9004029dc679c8304b4d3b3aa","observation_id":"d8a278c2-1262-4d40-9b19-592cc36099e7","resolution":{"observed_at":"2026-05-21T07:44:02.891790Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Defending against injection attacks through context-sensitive string evaluation","venue":null,"work_id":"e86ceb48-0043-4240-a3f8-f7a21662dcc3","year":2005},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:a43756d5c91cf66569712bf7a2bec38a3fcd1017da8a737aeb94a7d7c7514d45","observation_id":"0ff5fbf4-a095-463d-b2ce-947bad2a3be2","resolution":{"observed_at":"2026-05-21T07:44:03.342974Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Rehberger (wunderwuzzi)","venue":null,"work_id":"408fdeb3-d4e1-4a8c-82ea-5659ea655425","year":2024},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:3dae4363fc06661f08680620593a4b45f778376cb29506e4a35134a871101bee","observation_id":"14df11c6-79e1-4547-8390-e99195b083ca","resolution":{"observed_at":"2026-05-21T07:44:03.363772Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Rehberger (wunderwuzzi)","venue":null,"work_id":"0df5bc92-756e-42e9-b5aa-5ab106d2e60e","year":2024},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:8e7d0ad02de74ad757af6dab567010498717c16a10774f3daf022ad538e1be60","observation_id":"2177bfa5-3000-492e-a7c3-644cc4d8641d","resolution":{"observed_at":"2026-05-21T07:44:03.346491Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Rehberger (wunderwuzzi)","venue":null,"work_id":"74fd9579-c57e-459b-8154-0c3a757e03f6","year":null},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:d1c537d3892a6d2113c208d64034120e3093abd6e5e580a39b16135d890fd22f","observation_id":"2ed2b8ac-6498-4600-a6f1-b22159408f3a","resolution":{"observed_at":"2026-05-21T07:44:03.365348Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"c52a4be0-6128-44c1-8bdd-8146cc4b1d64","year":2024},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:8cb517354ca572b4da363a900011711db9d30bf51ba56eded45e04950300d783","observation_id":"90768332-4cdd-4fd2-ad33-990faa7a34c5","resolution":{"observed_at":"2026-05-21T07:44:03.336121Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Rehberger (wunderwuzzi)","venue":null,"work_id":"b3635822-daef-4cf0-9e6a-ee412fc17304","year":2024},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:486512048df6cadab461d6801c109380b96f8d74eaf90fb9a31829ad07ee422f","observation_id":"61fcc5e8-215a-4337-ba01-b15dd2a12a57","resolution":{"observed_at":"2026-05-21T07:44:03.340002Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Rehberger (wunderwuzzi)","venue":null,"work_id":"253f8125-2d40-4306-8189-c6dd4016a5e1","year":2024},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:2074464faa4c76422b69f0f7177682e96d07201ea5c97de6dde5119f1103dc73","observation_id":"0348d896-b265-4e12-9426-88a0ef8a3ba4","resolution":{"observed_at":"2026-05-21T07:44:03.372853Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Rehberger (wunderwuzzi)","venue":null,"work_id":"26a451ed-085e-4944-a759-037b39a010bd","year":2024},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:fbb475b5918e6f714473d1fa9a1b0f0a94d71199fc7d4fe24b6ef93bd620ad98","observation_id":"61ab9720-8ed7-4ffe-b31e-05a0a482b7b9","resolution":{"observed_at":"2026-05-21T07:44:03.354050Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Rehberger (wunderwuzzi)","venue":null,"work_id":"ee58419e-5cc0-45fb-935d-91d687169387","year":null},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:8de81e26ff9ec4d092145406e22fa801b2b2ed25a88105bc51569fd2ddb1712e","observation_id":"812317bf-6459-4ae7-8de4-3c1a8ace4fdd","resolution":{"observed_at":"2026-05-21T07:44:03.392885Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"6ec0eb32-2feb-4653-9d2d-11c0905a18c8","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:809876e7b6e0600f6d392d169d8c854a165158d97dafa020bfbb93881e76871d","observation_id":"dae67366-9e0d-4ccf-b8f5-464debc929fc","resolution":{"observed_at":"2026-05-21T07:44:03.315598Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Rehberger (wunderwuzzi)","venue":null,"work_id":"a6941369-ac80-48d8-9cf0-0f20ff71b725","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:92fc5d1d8b245511fd8702d612372a85d17f3925ca174f88acac88edcfe95321","observation_id":"fbaa7751-dede-4002-a925-da82a92ddcb3","resolution":{"observed_at":"2026-05-21T07:44:03.338927Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Rehberger (wunderwuzzi)","venue":null,"work_id":"bb576884-49e7-4753-a498-a92e4cc18b94","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:d2767a36e65aafb706b7101a7866ca880fd72bffce25b4bb8962022c51f4b0fb","observation_id":"dafecb2c-f6ac-478f-b104-20ce02c9a646","resolution":{"observed_at":"2026-05-21T07:44:03.313704Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Rehberger (wunderwuzzi)","venue":null,"work_id":"5b4c1bf1-35a3-4051-8e71-5cd16519be55","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:64b31d17e7973af62267ef61bccbf231f6ecf620d58e9aeb41367b214ab55b0e","observation_id":"cc850188-ba86-4102-b0ba-03f9602fdd1b","resolution":{"observed_at":"2026-05-21T07:44:03.317725Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"ad263c33-b716-4a40-9f81-8c19f2c152b8","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:15e50dc2a7b727d724b41c359c46116034c0720cb3bbad9eee57c646ccf99246","observation_id":"6c8e2a51-d084-49a9-b030-7d8cefaac4b0","resolution":{"observed_at":"2026-05-21T07:44:03.319460Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Rehberger (wunderwuzzi)","venue":null,"work_id":"27503edc-2005-4785-bdfa-92581c63b499","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:a97fc0ae669ca91251b52ed61d55ba31ecad21a34c31ff14404bb0ed56131064","observation_id":"8eb86a6d-b4f1-47bc-a66b-09c1872194d3","resolution":{"observed_at":"2026-05-21T07:44:03.321116Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Rehberger (wunderwuzzi)","venue":null,"work_id":"a3a38e73-bff2-4d49-9a26-20a6fb439841","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:0473cc19590b9e34cc28510a4acc9587d37a2912e8c61715c03d24a67d6d2fdd","observation_id":"6ccc64f3-aeff-4ae4-aab4-3fddf44571c5","resolution":{"observed_at":"2026-05-21T07:44:03.309824Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"User- driven access control: Rethinking permission granting in modern operating systems","venue":null,"work_id":"076cc236-e4aa-4239-87bb-8f1dac1a5d0c","year":2012},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:85b15052de15f19aa23400f32d9d7e60877cfc3218a82703dd20b717d145b37b","observation_id":"c192bab2-5c0f-4e4c-a6d7-f711d63bbebe","resolution":{"observed_at":"2026-05-21T07:44:03.322911Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Declassification: Dimensions and principles.Journal of Computer Security, 17(5):517–548","venue":null,"work_id":"e0c63ba0-4feb-49bd-a0a3-c873bea5c7c9","year":2009},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:524dd478198eaf24bb21286d0fbbfc0ef4892d0dbaaab7c19ff2881435509eee","observation_id":"8a527a95-5330-40a5-97e4-0299be959661","resolution":{"observed_at":"2026-05-21T07:44:03.325795Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"1975.9939","doi":"10.1109/proc.1975.9939","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Saltzer and M.D","venue":"Proceedings of the IEEE","work_id":"d9338ce1-d72f-4364-aa66-010938e40de4","year":1975},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:1cfc6617f58b0cc09f580b984a2aa114fe4a18ea3b3f717abe3e1751e4e6d106","observation_id":"83f1bc08-b8b8-40fe-a51f-eab85cba01e6","resolution":{"observed_at":"2026-05-21T07:44:02.474477Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-07-12T05:19:16.628362+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-12T05:19:16.628362+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.29038","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Trojan-speak: Bypassing constitutional classifiers with no jailbreak tax via adversarial finetuning","venue":null,"work_id":"345e5193-c7e6-433a-8eb5-9f68d9b62108","year":2026},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:5b68901de814f6c6740a5c13c5600d20f72530362cf3c2ca3eaa80cd07df2101","observation_id":"091c616c-f380-4beb-8a59-83e76f17b9e3","resolution":{"observed_at":"2026-05-21T07:44:02.927637Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"5245.131531","doi":"10.1145/1315245.1315313","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)","venue":null,"work_id":"1281ebf5-ac0c-4371-8180-643515806d6d","year":2007},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:ad1ab240e2d5c503e3927a64cb5aab10fa92cf1665e8c395fd2a3a30f19b8f5d","observation_id":"aa875be3-7f05-4168-9111-3604a6d3adb7","resolution":{"observed_at":"2026-05-21T07:44:02.477575Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.11703","last_updated":"2026-05-14T02:36:38Z","snapshot_observed_at":"2026-07-06T21:10:09.129714Z","submitted_at":"2025-04-16T01:58:40Z","title":"Progent: Securing AI Agents with Privilege Control","version":3},"cited_work":{"arxiv_id":"2504.11703","doi":"10.48550/arxiv.2504.11703","metadata_source":"pith","pith_arxiv_id":"2504.11703","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Progent: Securing AI Agents with Privilege Control","venue":"cs.CR","work_id":"193d98f2-c913-4d0c-814e-b550a64bd03c","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2504.11703","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:a8eaeadccec6ee270d77c3d6d8e0c1c8405b9fa9ad369c7ca263949751ad334a","observation_id":"773a395e-8f3f-4abe-acef-defb52c3951a","resolution":{"observed_at":"2026-05-21T07:44:02.911102Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"AgentFlayer: When a Jira Ticket Can Steal Your Secrets.https://labs.zenity.io/p/when-a-jira- ticket-can-steal-your-secrets, August 2025","venue":null,"work_id":"68494348-8cd2-43ce-b1a1-be62b5680b33","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:5ee44817c5bd45480b00bd12997b966c5feea624d673e658041a0d7725e335e2","observation_id":"0e6cb85c-c8ae-4c51-b350-394db539d2ba","resolution":{"observed_at":"2026-05-21T07:44:03.383608Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"On the foundations of quantitative information flow","venue":null,"work_id":"896bf3f0-de6e-4532-ab2b-f55cae84a3d8","year":2009},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:e3834a247ec4aea06d1723d09ba8478b8c4685c1d72194c92ca458fc0b468331","observation_id":"40adb646-d20d-421e-a36b-30c9154485fa","resolution":{"observed_at":"2026-05-21T07:44:03.389274Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.09222","doi":"10.48550/arxiv.2602.09222","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Muzzle: Adaptive agentic red-teaming of web agents against indirect prompt injection attacks","venue":"Open MIND","work_id":"4d2527e1-2167-4813-a66a-6b86ed646102","year":2026},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:e0bb28a96feb029dff3f23ae2c107fb35b983981c6fbe7e2a67191f8f4cb745f","observation_id":"59fc45c5-2e39-4292-8fb3-af2fec4065b9","resolution":{"observed_at":"2026-05-21T07:44:02.920698Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"SAGA: A Security Architecture for Governing AI Agentic Systems","venue":null,"work_id":"e451f59d-3e1a-45cd-8d38-699175ebf061","year":2026},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:50bba03254d1aba79cae586281822984ec04fa4a095d0b314dd9722627fd9446","observation_id":"44d4dc1d-ad2f-4780-95cd-a8dfc9faac4e","resolution":{"observed_at":"2026-05-21T07:44:03.389111Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Lee, and G","venue":null,"work_id":"f92124a2-425b-4100-86cc-9870e520bc00","year":2024},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:a45359a1b54e774216c3696511ddbcaab67afd1aa7e30090f6d2738b39437aa1","observation_id":"45d85981-62ad-4218-8748-37b5138ca9d9","resolution":{"observed_at":"2026-05-21T07:44:03.380162Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"AI Agent, AI Spy.https://media.ccc.de/v/39c3-ai-agent-ai-spy","venue":null,"work_id":"67eb8e38-fa46-4bbe-9b03-d485878c8044","year":null},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:69f77152d78ae731d4b34482f27b36141d2c70f6cb53c4ebd2961e0ebfafad72","observation_id":"eb086d68-01f4-464f-95c8-82f8eb339b0a","resolution":{"observed_at":"2026-05-21T07:44:03.387385Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-02T11:48:17.206729Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":"2404.13208","doi":"10.48550/arxiv.2404.13208","metadata_source":"pith","pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","venue":"cs.CR","work_id":"ba941a96-eb3b-48c0-b52c-5e9463085190","year":2024},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:95303db53d967c00a22539a6ac96029090e6bf1e8130bd4d385fb2333f154075","observation_id":"41b5147f-8858-4d46-845d-fe7f65bf9efd","resolution":{"observed_at":"2026-05-21T07:44:02.923757Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-07-06T21:21:20.149404Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:74774e15d5fe2c2a1776b317e9243ad70480b5cfb50e3bd8ecc10f59a25068a2","observation_id":"f3353e1c-a6ab-42ad-94a8-a09152700dd7","resolution":{"observed_at":"2026-05-21T07:44:02.914269Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.09102","last_updated":"2025-03-01T19:06:35Z","snapshot_observed_at":"2026-08-04T17:29:52.046121Z","submitted_at":"2024-10-09T12:52:41Z","title":"Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchy","version":2},"cited_work":{"arxiv_id":"2410.09102","doi":"10.48550/arxiv.2410.09102","metadata_source":"arxiv_reference","pith_arxiv_id":"2410.09102","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchy","venue":"arXiv (Cornell University)","work_id":"8ce36bb7-e2e5-4b6b-b2eb-4ddea0c841ce","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2410.09102","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:fec0aae1e6a8a13e0374cd6d0f79d5be5b10d4b5cd5c7934618c88a2c2e05967","observation_id":"f74e7824-c3ed-417d-b32b-62f69ddd089b","resolution":{"observed_at":"2026-05-21T07:44:02.917307Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":"2307.15043","doi":"10.48550/arxiv.2307.15043","metadata_source":"pith","pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","venue":"cs.CL","work_id":"3322fa86-1768-4677-8425-dd326b45e078","year":2023},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:53f8f296531fb3f8c1fedab818806e4474a052c8c11d0fa3b5393fe27b220afa","observation_id":"eae530ac-733a-47ed-a914-d8f12bdfcc5c","resolution":{"observed_at":"2026-05-21T07:44:02.930917Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-07-15T23:50:40.271168+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T23:50:40.271168+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Terminal DiLLMa","venue":null,"work_id":"f08f2259-fe5d-4e01-93d9-07c2be8c0b36","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:64c03048476db066734b64110b27c5f072346ff6f87b1cb66ded4ba5d96ebca0","observation_id":"76e321e5-6af5-4b98-ae1a-52080a990d3c","resolution":{"observed_at":"2026-05-21T07:44:03.392470Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem"},"reference_resolution":{"displayed":78,"state_counts":{"malformed_identifier":0,"metadata_mismatch":4,"parse_uncertain":0,"unresolved":3,"verified_exact":23,"verified_fuzzy":48},"total_outbound_references":78},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"thesis":"As of 7 August 2026, this Paper Citation Record lists 78 of 78 outbound references and 1 inbound Pith citation observation for arXiv:2605.18991."}