{"as_of":"2026-08-06T13:50:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:4bbb5cbe864f8f6f0c353a9caf59f0339c16913802d4cbb29c06ce89be46a904","coverage":[{"denominator":35,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":35,"source":"paper_references, paper_reference_links","source_observed_at":"2026-06-28T00:25:05.443939Z","state":"measured"},{"denominator":35,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":35,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-06T06:34:29.942622+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2606.06387/citation-record","integrity":"/paper/2606.06387/integrity","json":"/paper/2606.06387/citation-record.json","paper":"/paper/2606.06387"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"NDSS , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:5404332a5c201d4a4388f3af4e18d3c23483327a26512c8294e6dec03785a4f9","observation_id":"b2e09993-db76-4223-8827-4ddf2de6ddc9","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Zenodo , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:16d89f9d32674d2f3512d7d43e68c5225700acfa278ea5b7123a72cf1e384d3f","observation_id":"e5fbc4d2-4d0b-4bf6-8f80-e8c17a4b36f4","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2509.20386","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-02T14:37:03.233506Z","title":"arXiv preprint arXiv:2509.20386 , year=","venue":null,"work_id":"74ff7244-4005-412d-bf74-52b0737768be","year":null},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:0feda72c1bf3bbc647a5758f8998cd9d69393212d9280675474c826573b66433","observation_id":"3f2171c8-3f2b-4fe3-be33-56f50c7c999a","resolution":{"observed_at":"2026-07-02T14:37:03.234963Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"34th USENIX Security Symposium (USENIX Security 25) , pages=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:f2727544ccc01ab6e9af37dea42f4cba592c56ca2f41df1e6e4c4cdd165b5fe8","observation_id":"3f9dfbd1-4026-4287-b744-7d1aa49b4dd6","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Advances in Neural Information Processing Systems , volume=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:1f086de60053edbfab1cd397220af7bbc8f4841aa1070e392473bb05bec136b1","observation_id":"3e301ccb-e2f7-4960-8e19-a723d65b1155","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Automatic Red Teaming LLM-based Agents with Model Context Protocol Tools , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:2851575ccd46f433cb58c94f148c2db267073963d137762ef4bc20ae3c99551b","observation_id":"323c740e-855a-4ac4-b932-e192a60d8daa","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"NDSS , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:a20a1c0bcba39c3ef9bc856b46f3388e9ca86485ee09605530c2248410bac371","observation_id":"f60cedea-3fb7-4e67-b9c5-4c1d5e8322a6","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:3042cdc3a0e282f580dcce706e8ce858a969cbb85f18e9d6186573e4d8ef538c","observation_id":"7d9623dd-b04d-422a-a518-9875e8ac4513","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"IJCAI , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:91bfad31859f69f5973d3d1269cad8fe5c88311204676b68fc562d9203ab129d","observation_id":"9433589d-780a-4303-b60c-16eb6cf714e3","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"ACM Transactions on Software Engineering and Methodology , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:61208c549f9e9eb5019b7090bdda6d4607d01548a7bab96d67b49ed26af066d4","observation_id":"e70cd65c-8595-4934-bed5-264193e8780b","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Computer , volume=","venue":null,"work_id":null,"year":2005},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:155d2df55346399a98ca4a8f24ccd62e8064fe3be5d3a7f8ab8a9f9bbb01e5d8","observation_id":"4beb326e-d133-43a8-8d19-e6fd04bf08c1","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Information , volume=","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:1a5bebc8e3f805d6751200f85e63744a958ec36c94c29fe6f32d259fa5502d21","observation_id":"f9b641d0-6747-4165-9c0a-8654b7de4b7f","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Ieee Access , volume=","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:67a779fdaabcf0250b2976b80f50144848531cde04957f1a3209810e939321cb","observation_id":"312c35ed-0ca0-4eed-ac66-7b01d24f3009","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"AJCAI , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:8f7eb5949214ccfb7c5ec212bcd9fb0f9c92b7916b727ab972898bbc6bfe79b4","observation_id":"c2a10d17-0627-4f7e-96af-9128f006ba91","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:59bf70813a743174de64bc40230200a53243cb8f889e2c6ef3b96d5d0b367ca1","observation_id":"9de510cd-2e38-49c3-a830-9d88c498e88b","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Les dissonances: Cross-tool harvesting and polluting in pool-of-tools empowered llm agents","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:1a0205ce19de89810988bdbc1eb915386e322a80ca806566a082b75d7a2afaa3","observation_id":"79a58412-1075-42e2-a125-ff5caa0d0ecd","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.15495","last_updated":"2025-08-26T16:40:49Z","snapshot_observed_at":"2026-07-06T20:10:37.385214Z","submitted_at":"2024-12-20T02:21:36Z","title":"TL-Training: A Task-Feature-Based Framework for Training Large Language Models in Tool Use","version":2},"cited_work":{"arxiv_id":"2412.15495","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2412.15495","snapshot_observed_at":"2026-07-02T14:37:03.249565Z","title":"Cybersecurity For Beginners","venue":null,"work_id":"4a473ca2-c295-4acc-8dc4-1f90035b2e29","year":2024},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"cited_paper":"/paper/2412.15495","citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:0903ac8b987f9e126b1820e038edc76ba6a39d1d44da599f38660c78a134edf3","observation_id":"7a37d445-5a20-4989-8bb3-735b81527a6e","resolution":{"observed_at":"2026-07-02T14:37:03.251077Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2026.369120","doi":"10.1109/tifs.2026.3691201","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Automatic red teaming llm-based agents with model context protocol tools","venue":"IEEE Transactions on Information Forensics and Security","work_id":"622d15e1-6d41-4c35-aafb-57e1407082a5","year":2026},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:104000c2c6228ba4411448962f134aff644b49bff87e153806a90ac702cabbb3","observation_id":"db37fca0-4aa7-4f88-a5eb-dc32b0f2bf0e","resolution":{"observed_at":"2026-06-28T01:41:29.929052Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:94e459355a750a895465746fd4c8df649fcb0727e9f37b94fb8f430fc4c9f6c6","observation_id":"55ee006a-c810-45be-abba-48172a2a47ed","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"\\ StruQ \\ : Defending against prompt injection with structured queries","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:e50e67b652aa182b7173dca6d0f95234f43a9d6dd1347377a1dfabb58c7d6e0b","observation_id":"ac2f3cb4-634b-49ee-80c2-3d51073bbfce","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"The temporal coherence problem: Synthetic point-in-time environments for evaluating llm agents with dynamic tool dependencies","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:85801ba1da7f043a2f0e637879fd74d588746ddf0003a557e6ebcfb6f23b9717","observation_id":"a1d49e6f-4d07-4e67-84f3-b54be81bb7cb","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"cited_work":{"arxiv_id":"2604.01905","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.01905","snapshot_observed_at":"2026-07-02T14:37:03.245592Z","title":"Huang, Z","venue":"cs.CR","work_id":"4e9b9c89-da60-4d82-8f33-824ceeba8bbd","year":2026},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"cited_paper":"/paper/2604.01905","citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:a0c9f9bad112cb460b1b352c309bfd628ddec2ec2a3aa3250fde4d6da1a4214e","observation_id":"5f52ee4b-68c4-4a30-86b3-b9eaf2d97f1a","resolution":{"observed_at":"2026-07-02T14:37:03.247134Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Obliinjection: Order-oblivious prompt injection attack to llm agents with multi-source data","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:a23fe66ec49f788ce4033e507a6dae73c66ce62599d0ad41cd1cdc8cd9eb4ce7","observation_id":"bdb3f4b7-89f3-4a56-be5b-3deba8dd82b2","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Model context protocol (mcp): Landscape, security threats, and future research directions","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:e497677ad65299d3445bf6c49ce9955aa82b7f4ed8c2e49a03be99b8d2617077","observation_id":"4436dc1a-2fed-4466-bee9-ac444d6ed065","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2509.24272","doi":"10.48550/arxiv.2509.24272","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"When mcp servers attack: Taxonomy, feasibility, and mitigation","venue":"ArXiv.org","work_id":"4df473ca-7315-4733-8c17-9a74916114e4","year":2025},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:55974060baf256a4bc30416f48989d55883a35910b12afeca18f75984f38b42f","observation_id":"c8cb2dc7-1c85-409f-9bcb-38b54605e459","resolution":{"observed_at":"2026-07-02T14:37:03.248525Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Webinject: Prompt injection attack to web agents","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:a44437b742675ca96a9cf10c1dc9ce0f35cf63fef64544a091fb027bb146f75c","observation_id":"687285f5-ff5e-4b2c-a80e-54141d744a06","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Odyssey: Empowering minecraft agents with open-world skills","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:18152ab59b4aeb26dfb23c2a5db9399f7ec47ca744c77662de7ca8b1c8c88d48","observation_id":"6042ea31-4017-4c3a-8f80-50b6c2ac819d","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.20720","doi":"10.48550/arxiv.2602.20720","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Adaptools: Adaptive tool-based indirect prompt injection attacks on agentic llms","venue":"Open MIND","work_id":"48c84b95-240f-47b2-a3e9-7a5884819c1e","year":2026},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:2a0a0feb3b150e90d02f0e6fd94288dddd6b0286eb0fefffb647f751803e9a7b","observation_id":"99e9aa51-f5bd-4034-b0a7-941a5fece382","resolution":{"observed_at":"2026-07-02T14:37:03.245819Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Topicattack: An indirect prompt injection attack via topic transition","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:63a869b4fcbc4c02519c51418e5d7140f43fc0ea463baa0dd039d6c6cf85becb","observation_id":"0b2ced28-69df-4c07-8ccc-f194de081c8a","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Prompt injection attacks in large language models and ai agent systems: A comprehensive review of vulnerabilities, attack vectors, and defense mechanisms","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:6292b4249fb6ccb0e28554711d3be208240804420b16434a53f9d7b2f4ef693e","observation_id":"accfe192-5c5e-4942-b183-3aaca9012dc6","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Artificial intelligence crime: An overview of malicious use and abuse of ai","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:1309aef3425f5a67cc22a7ab5ffb3b586d7969b7bb0b8cb4ad9a20f2e3dea700","observation_id":"a1bf0e3e-5c49-4232-ac50-5a488a7aa345","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"Advancing embodied agent security: From safety benchmarks to input moderation","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:9fac22bd92d4f02b12e2e79e52d255bb8fdc5cc82d768314891fbe77f67911d4","observation_id":"f762d467-1d66-47b9-96a0-ded1abec6922","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.26221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T02:47:50.556921Z","title":"Clawed and dangerous: Can we trust open agentic systems","venue":null,"work_id":"9e98f84a-76d7-40db-8a80-a95f74f91225","year":2026},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:40236805f0abcdc63d642680c54119acb94554ddf53fc99635f9f30f977630ea","observation_id":"10c8286c-c7f1-4730-bab0-86be720276b6","resolution":{"observed_at":"2026-07-02T14:37:03.243092Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.19469","doi":"10.48550/arxiv.2603.19469","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"A framework for formalizing LLM agent security","venue":"arXiv (Cornell University)","work_id":"8485b11a-643b-4feb-9382-8fcb141bb657","year":2026},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:c2356c63a64cabdfb3d84236ce6c0d49781423a275fb1ac5bc25168d36b6a235","observation_id":"aabab065-9c7e-4b32-ac4a-fa6eb7d98e94","resolution":{"observed_at":"2026-07-02T14:37:03.253220Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-28T00:25:05.443939Z","title":"@mcp-b/global: W3C Web Model Context API polyfill","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:13ee962c2de9b314c9ac85b5c387ae266580466be6b99a5b5551c75eaf63a188","observation_id":"be045717-7e52-4ec9-b882-cc70a703099a","resolution":{"observed_at":"2026-06-28T00:25:05.443939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents"},"reference_resolution":{"displayed":35,"state_counts":{"malformed_identifier":0,"metadata_mismatch":2,"parse_uncertain":0,"unresolved":27,"verified_exact":6,"verified_fuzzy":0},"total_outbound_references":35},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"thesis":"As of 6 August 2026, this Paper Citation Record lists 35 of 35 outbound references and 0 inbound Pith citation observations for arXiv:2606.06387."}