{"as_of":"2026-08-06T21:02:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:64de882ef00e7137489558171a509f297c57952d3f23fffda87593fe24f0c6f7","coverage":[{"denominator":67,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":67,"source":"paper_references, paper_reference_links","source_observed_at":"2026-06-27T12:47:09.467463Z","state":"measured"},{"denominator":67,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":67,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-06T06:34:29.942622+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2606.10525/citation-record","integrity":"/paper/2606.10525/integrity","json":"/paper/2606.10525/citation-record.json","paper":"/paper/2606.10525"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2404.02151","last_updated":"2025-04-17T18:55:45Z","snapshot_observed_at":"2026-07-06T17:54:43.685212Z","submitted_at":"2024-04-02T17:58:27Z","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","version":4},"cited_work":{"arxiv_id":"2404.02151","doi":"10.48550/arxiv.2404.02151","metadata_source":"arxiv_reference","pith_arxiv_id":"2404.02151","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"arXiv preprint arXiv:2404.02151 (2024)","venue":"arXiv (Cornell University)","work_id":"81e706c8-459e-40a1-a79d-bda6a104cd22","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2404.02151","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:e6b3d723dfb453f64d0c80d0d134868dad519bb6bddb0fe42c65a89df7a146d1","observation_id":"e2175545-0e6c-455f-85bb-b4283b9ad0ef","resolution":{"observed_at":"2026-07-03T06:17:41.960012Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2507.04446","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-03T06:17:41.941605Z","title":"Sampling-aware adversarial attacks against large language models.arXiv preprint arXiv:2507.04446, 2025","venue":null,"work_id":"64f6c387-0a94-437c-b2af-1a188d95ddfa","year":2026},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:53a472f54f9af110b3b9c851c1b31e38801d05a7b4d70b47f8356bb150b2f50f","observation_id":"1ee7f075-e77d-4fbf-8a18-e534f02540bd","resolution":{"observed_at":"2026-07-03T06:17:41.943108Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":"2310.08419","doi":"10.48550/arxiv.2310.08419","metadata_source":"pith","pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","venue":"cs.LG","work_id":"38678cda-6595-4ca3-916b-066c00cce063","year":2023},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:0d4cf54af945a4b0d48ce2bcd2c025c7216b87e975cd036c07647d536c07eea5","observation_id":"24b8f3eb-08b9-4573-ba88-a0e705d9f59a","resolution":{"observed_at":"2026-07-03T06:17:41.965090Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-05-24T00:53:06.618013+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-24T00:53:06.618013+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:c6f955e19e7a79056dda31d01d3d7610001ef6b7b5fdbea3e89ab06fce72c28c","observation_id":"6b1d030d-ef0b-4e7a-a46d-94163d3bdb38","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"9027.374483","doi":"10.1145/3719027.3744835","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"URL https: //doi.org/10.1145/3719027.3744835","venue":null,"work_id":"b79879de-86b3-4660-88bd-39ed431563e6","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:b43d805e3e5804c5c6ff58a5b3be63dd7b6a0489d5f1c5b08d3ebfda96e5f890","observation_id":"915b0cdd-a67d-4278-92f4-9ef813886252","resolution":{"observed_at":"2026-06-27T12:50:55.669003Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2507.02735","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:58.857965Z","title":"Meta secalign: A secure foundation llm against prompt injection attacks","venue":null,"work_id":"69776aad-e4d1-4d24-bb01-59055547fa49","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:8d5dc7e77162a5d8d0096df0e7c9bbc25fef6fba008f7b816951b21d6ecfb1c8","observation_id":"63691e42-5416-44d0-805b-97a3e15d0d63","resolution":{"observed_at":"2026-07-03T06:17:41.963869Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2602.05746","last_updated":"2026-06-10T08:55:54Z","snapshot_observed_at":"2026-08-03T04:13:45.517910Z","submitted_at":"2026-02-05T15:14:46Z","title":"Learning to Inject: Automated Prompt Injection via Reinforcement Learning","version":2},"cited_work":{"arxiv_id":"2602.05746","doi":null,"metadata_source":"pith","pith_arxiv_id":"2602.05746","snapshot_observed_at":"2026-07-03T06:17:41.924919Z","title":"Learning to inject: Automated prompt injection via reinforcement learning","venue":"cs.LG","work_id":"6a117cdb-7e8c-41b6-aa28-b943f3aaec18","year":2026},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2602.05746","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:b4affd7c0735cd59d26ab24e6d0fe27a4603669b0c07ac7dea95591bba6ec0c9","observation_id":"21b6af64-9a94-428c-8ff3-4a3c7e239617","resolution":{"observed_at":"2026-07-03T06:17:41.929906Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:60e7f4065b78a27e12bbddec1ec4124a87c25790e9a9bbabb32cfd00c50d46c7","observation_id":"2e545c43-6a8a-4082-9c79-2cf247cedcb9","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.23643","last_updated":"2025-09-03T12:30:47Z","snapshot_observed_at":"2026-07-06T21:33:02.686798Z","submitted_at":"2025-05-29T16:50:41Z","title":"Securing AI Agents with Information-Flow Control","version":2},"cited_work":{"arxiv_id":"2505.23643","doi":"10.48550/arxiv.2505.23643","metadata_source":"pith","pith_arxiv_id":"2505.23643","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Securing AI Agents with Information-Flow Control","venue":"cs.CR","work_id":"58ee5225-7de4-4e38-b970-5afd29ddd925","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2505.23643","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:6383a1fd140d2f5669af7ac007747e2ecf723c01024b5be26905498cd7114e75","observation_id":"a194b1da-09d8-4316-a2cc-a34a5341fac4","resolution":{"observed_at":"2026-07-03T06:17:41.855000Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-06T07:36:52.841128Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:a7b2ab655ec6f8b14e586ab8ec3941197348d8784d74060082fab9484816a6bd","observation_id":"c5a085ea-1145-4b70-a35c-4a057d34e657","resolution":{"observed_at":"2026-07-03T06:17:41.846662Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:2d6391e6e238a136e2ea5c1908e22ef2f75977f437e84c555176f10206184813","observation_id":"178ae034-1097-4fcf-b79e-8610f6c32b11","resolution":{"observed_at":"2026-07-03T06:17:41.857461Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:ccbe9e42fea4c8e2e9daa04c6333743e2e8f0473d40d00486f0b08ab099ced66","observation_id":"4c9ed9a3-6450-496c-9aa7-dd3d6f99700f","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.15714","doi":"10.48550/arxiv.2603.15714","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"& Kolter, Z","venue":"arXiv (Cornell University)","work_id":"e2704c92-1015-4c75-82a4-6a1a36fb9a5f","year":2026},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:fb9f4aedc3da7b72a507936513b4a1c9344c9eafd562f27e81e6402299b89a7b","observation_id":"17a697c7-e944-4869-a765-ba8ef2c3ed25","resolution":{"observed_at":"2026-07-03T06:17:41.863770Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.14923","last_updated":"2024-10-22T00:53:48Z","snapshot_observed_at":"2026-07-06T19:36:19.567469Z","submitted_at":"2024-10-19T01:00:57Z","title":"Imprompter: Tricking LLM Agents into Improper Tool Use","version":2},"cited_work":{"arxiv_id":"2410.14923","doi":"10.48550/arxiv.2410.14923","metadata_source":"arxiv_reference","pith_arxiv_id":"2410.14923","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Gupta, Taylor Berg-Kirkpatrick, and Earlence Fernandes","venue":"arXiv (Cornell University)","work_id":"00099e88-7d52-4846-aa97-0e49e327a206","year":2024},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2410.14923","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:ad35e1cb168f88abd5963016f8d3489bb32eb288b9699f379266895669d3ecd0","observation_id":"79b665f1-26d8-4d01-bda8-fcab0f5f660b","resolution":{"observed_at":"2026-07-03T06:17:41.981522Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.19786","last_updated":"2025-03-25T15:52:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-03-25T15:52:34Z","title":"Gemma 3 Technical Report","version":1},"cited_work":{"arxiv_id":"2503.19786","doi":"10.1007/978-3-540-48085-3_36","metadata_source":"pith","pith_arxiv_id":"2503.19786","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Gemma 3 Technical Report","venue":"cs.CL","work_id":"f93e08bf-9e96-409b-8ac6-b8385fd17fd7","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2503.19786","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:496caf16224edd1024e48d943af0b837ca680c695e923462ebe7834d49ec5de3","observation_id":"46d7cb98-b107-493f-9213-0a5be6c2e030","resolution":{"observed_at":"2026-07-03T06:17:41.990836Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"5764.362398","doi":"10.1145/3605764.3623985","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"InProceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec @ CCS 2023)","venue":null,"work_id":"0b235739-d106-431c-aed9-3675d531c886","year":2023},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:8ff876f4358bcc771525395629a8419f548a366e183ab7ec981405525bc88c19","observation_id":"aeca2500-7405-4bd9-9cb8-ccb3e7ff5648","resolution":{"observed_at":"2026-06-27T12:50:55.655383Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-07-12T05:19:17.163767+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-12T05:19:17.163767+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14720","last_updated":"2024-03-20T15:26:23Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-20T15:26:23Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","version":1},"cited_work":{"arxiv_id":"2403.14720","doi":"10.48550/arxiv.2403.14720","metadata_source":"pith","pith_arxiv_id":"2403.14720","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","venue":"cs.CR","work_id":"c18cd975-e731-4e0f-a99f-a37d846cdd31","year":2024},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2403.14720","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:10e7382abbdf615ee1c974243d06283f897affffbc0e3d9ede6f39f17b8df1a4","observation_id":"e3bf848b-5e03-4b33-b18f-6fc0420a2afc","resolution":{"observed_at":"2026-07-03T06:17:41.975379Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:eff9b69fcbd2271eb536e7528551512f92f31d01ccd7e711fdfa08a5bcdc8c6a","observation_id":"2742897c-e321-476f-be48-6b5b682c8976","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2509.25926","last_updated":"2026-05-08T20:20:45Z","snapshot_observed_at":"2026-08-03T05:05:32.296943Z","submitted_at":"2025-09-30T08:20:50Z","title":"Preventing Prompt Injection with Type-Directed Privilege Separation","version":2},"cited_work":{"arxiv_id":"2509.25926","doi":"10.48550/arxiv.2509.25926","metadata_source":"pith","pith_arxiv_id":"2509.25926","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Preventing Prompt Injection with Type-Directed Privilege Separation","venue":"cs.CR","work_id":"c911f672-2271-4299-81c2-ec72e1868dac","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2509.25926","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:47a2735436c3dce2149c8de5d2c04c9b77e96cc675932c9f98d33ebe3fbc42a5","observation_id":"ba11e2fc-3eb9-46cb-8184-05f6f701777c","resolution":{"observed_at":"2026-07-03T06:17:41.954467Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:ef354875c54126a49799aad9ff155e7be1ba2ec07611625c893c9cb0e8db083f","observation_id":"4e80470c-e098-47e9-9ab7-010b726dc5f9","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.15547","last_updated":"2025-04-21T02:10:14Z","snapshot_observed_at":"2026-07-06T20:55:37.484364Z","submitted_at":"2025-03-17T05:27:57Z","title":"Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents","version":2},"cited_work":{"arxiv_id":"2503.15547","doi":"10.48550/arxiv.2503.15547","metadata_source":"pith","pith_arxiv_id":"2503.15547","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Prompt flow integrity to prevent privilege escalation in LLM agents","venue":"cs.CR","work_id":"0f5477d1-7cdc-4b40-934b-22a4e1d9ef2b","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2503.15547","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:f71928d2c01e0b7bd395a0eb5414e131d77a7a05f5c6c60a755e153d72a62189","observation_id":"4cfbbdf1-4b0e-42cf-b063-10f2eab4c9d9","resolution":{"observed_at":"2026-07-03T06:17:41.955388Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.07918","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T09:19:43.617715Z","title":"arXiv preprint arXiv:2602.07918 , year=","venue":null,"work_id":"a52b9761-7a96-4dbc-98a4-15cf70b63682","year":2026},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:85b70961f9fc1dc5988b4785f8d238ec817f42290cdf11d3b56d5018f2c58f02","observation_id":"3fdbf6e5-ccbc-4ddf-b86d-238856fdc238","resolution":{"observed_at":"2026-07-03T06:17:41.966712Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:2e340281fcab3891cc7f957bd5e232820bc71face2e05a2afdacd2ee41dfe3c1","observation_id":"88cc671f-635b-4b63-ae00-9b07b08a847c","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2026.230352","doi":"10.14722/ndss.2026.230352","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Robertson, Alina Oprea, and Cristina Nita-Rotaru","venue":null,"work_id":"3a9e1580-d418-4688-a063-818f7070794d","year":2026},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:fbd01fd4c6227fc21e360524e13e08effc10b264782ecd0d05d73cf25c27024b","observation_id":"20b9044d-e263-4c9a-aa21-47d80a5c24ec","resolution":{"observed_at":"2026-06-27T12:50:55.666607Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2602.03117","last_updated":"2026-05-07T07:42:14Z","snapshot_observed_at":"2026-07-06T22:44:18.875334Z","submitted_at":"2026-02-03T05:20:42Z","title":"AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?","version":3},"cited_work":{"arxiv_id":"2602.03117","doi":"10.48550/arxiv.2602.03117","metadata_source":"pith","pith_arxiv_id":"2602.03117","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?","venue":"cs.CR","work_id":"5164f177-b5ab-4d9c-ac93-125e92bf1f5a","year":2026},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2602.03117","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:ffaf54e73b7df2df9b082a02183fa31838116c6f70e5af3d38c64d7d8958c2c8","observation_id":"fbf4a131-38e0-44b2-b1e3-7493e7485c40","resolution":{"observed_at":"2026-07-03T06:17:41.969697Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-07-15T19:20:23.920036+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T19:20:23.920036+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:2bab908b683e4413e44582339cb4a82def2992069e6f15ee5115acc6e2ac125d","observation_id":"964d2a29-652f-4aaa-96fd-86f779c9a300","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:7ec8aa925f517986691dbb826b02493fd1b5e32f6e01efe692405f308a290099","observation_id":"ca83f5c8-0ff8-4968-8413-298cb1059493","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:b1b222e242f4b322b9a5bfe886e55470b490c08d91f672810a1ac1cb76e10d35","observation_id":"67a01730-8438-4960-8089-122be29bf809","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:74adf1ef62391e6a2fa95022efc17df928f0443cb679e4f0a81a90fd187b6b3b","observation_id":"179b5120-023f-49cf-bfe2-b7bf91c6b347","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2510.09023","last_updated":"2025-10-10T05:51:04Z","snapshot_observed_at":"2026-08-03T03:11:42.084785Z","submitted_at":"2025-10-10T05:51:04Z","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","version":1},"cited_work":{"arxiv_id":"2510.09023","doi":"10.48550/arxiv.2510.09023","metadata_source":"pith","pith_arxiv_id":"2510.09023","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","venue":"cs.LG","work_id":"585d66b7-a25c-4390-a7c8-8b15064c122f","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2510.09023","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:b12a23062bffd63fac515409810d5ab5d33fbf8119c7f475b2b1bd696979e911","observation_id":"85ddeca4-b393-4b24-af65-21ea2c5ddafb","resolution":{"observed_at":"2026-07-03T06:17:41.986826Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2601.03420","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-03T06:17:41.938891Z","title":"Schmidt, and Florian Bernard","venue":null,"work_id":"480a94a7-7694-458a-acdb-1544a8567693","year":2026},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:673e10fec8e40fd6e0a7e457aaf8828a73d7a5f79c96702875185e3f1b12fb39","observation_id":"103ee248-3490-449f-955e-83b53478bf4a","resolution":{"observed_at":"2026-07-03T06:17:41.940417Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:3ec43244d04e178df56014f9ba99b93a3da3aca172c70e30cd8d881806abdcb3","observation_id":"4041e4c6-687d-4594-9def-f976606b0e2a","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.00843","last_updated":"2025-05-01T20:09:48Z","snapshot_observed_at":"2026-07-06T21:17:47.318369Z","submitted_at":"2025-05-01T20:09:48Z","title":"OET: Optimization-based prompt injection Evaluation Toolkit","version":1},"cited_work":{"arxiv_id":"2505.00843","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.00843","snapshot_observed_at":"2026-07-03T06:17:41.897796Z","title":null,"venue":null,"work_id":"ff0aa3aa-dcc4-4931-9900-f66a7363e9c7","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2505.00843","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:fa2dfe696233173d19f4c9292cb39f7f371b27033cd3729bae564c507284b5d6","observation_id":"7f679763-cc3a-4c24-8125-049799287f05","resolution":{"observed_at":"2026-07-03T06:17:41.899803Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2507.07417","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T13:39:51.357615Z","title":"Pandya, Andrey Labunets, Sicun Gao, and Earlence Fernandes","venue":null,"work_id":"8fd877bd-d4d6-470c-92cc-df0265a6e4b7","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:2cdc43314b6963c2f18deee8bf90f47ceb4ff7f737bb165ff344dcd91b0f4a53","observation_id":"8c451372-cbde-49be-9b33-d29787b7304e","resolution":{"observed_at":"2026-07-03T06:17:41.897950Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.03792","last_updated":"2024-05-02T09:25:38Z","snapshot_observed_at":"2026-07-06T17:40:29.558340Z","submitted_at":"2024-03-06T15:40:30Z","title":"Neural Exec: Learning (and Learning from) Execution Triggers for Prompt Injection Attacks","version":2},"cited_work":{"arxiv_id":"2403.03792","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2403.03792","snapshot_observed_at":"2026-07-03T06:17:41.932219Z","title":"Neu- ral exec: Learning (and learning from) execution triggers for prompt injection attacks","venue":null,"work_id":"47349134-5f8f-469c-b2b0-eabf8e389cd2","year":2024},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2403.03792","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:98cc8f19b066ed8bf68747075f38f75f12aa5b5b13cff37adf19ab44f373e458","observation_id":"64bd7d9f-4c8d-4548-8f2e-014e775cf0b1","resolution":{"observed_at":"2026-07-03T06:17:41.936259Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2211.09527","last_updated":"2022-11-17T13:43:20Z","snapshot_observed_at":"2026-07-06T14:19:47.424778Z","submitted_at":"2022-11-17T13:43:20Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","version":1},"cited_work":{"arxiv_id":"2211.09527","doi":"10.48550/arxiv.2211.09527","metadata_source":"pith","pith_arxiv_id":"2211.09527","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","venue":"cs.CL","work_id":"a7c5b6ec-3407-4330-96c8-3fc58e7d410b","year":2022},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2211.09527","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:fcfbe7ffbbed9ef7ab47f7ed9f7704e8f365cc0d13fbf9d5520b7b1a8d31bacb","observation_id":"3094d42c-5fa7-4ca0-9b85-25eb5f8f8652","resolution":{"observed_at":"2026-07-03T06:17:41.946439Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-05-24T11:53:03.018758+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-24T11:53:03.018758+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:4f296a201699e07b4bec6f6c1f0e2fa21dfcd44f4ed311da6134ed90933421ee","observation_id":"e400f000-afd5-4203-bad2-5d11f5110455","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":"2019.Language Models are Unsupervised Multitask Learners","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:8a3b74563328f8ebb13bdc8dc6d6cf727d789240b22becbbe3964e24382a14c5","observation_id":"7f19c3da-a3ea-410a-acd0-feb6b13e3a5a","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:c398b1c50f6894114373912096df68105d6184604d5ae74c076d95278e6d2a7d","observation_id":"f43af389-6a73-46f3-b5d8-ed7cc9bfcd94","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.19793","last_updated":"2025-08-24T03:28:21Z","snapshot_observed_at":"2026-08-01T07:24:09.967062Z","submitted_at":"2025-04-28T13:36:43Z","title":"Prompt Injection Attack to Tool Selection in LLM Agents","version":3},"cited_work":{"arxiv_id":"2504.19793","doi":"10.48550/arxiv.2504.19793","metadata_source":"pith","pith_arxiv_id":"2504.19793","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Prompt Injection Attack to Tool Selection in LLM Agents","venue":"cs.CR","work_id":"0224da95-0f8f-4479-bb4e-602bec01d31c","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2504.19793","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:800b5b29063e346cf78e367dd91960ed4cb6d9041f60d68cccf703f27117dd76","observation_id":"24aadd62-b927-46f1-8f53-9be0fe420317","resolution":{"observed_at":"2026-07-03T06:17:41.892122Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.11703","last_updated":"2026-05-14T02:36:38Z","snapshot_observed_at":"2026-07-06T21:10:09.129714Z","submitted_at":"2025-04-16T01:58:40Z","title":"Progent: Securing AI Agents with Privilege Control","version":3},"cited_work":{"arxiv_id":"2504.11703","doi":"10.48550/arxiv.2504.11703","metadata_source":"pith","pith_arxiv_id":"2504.11703","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Progent: Securing AI Agents with Privilege Control","venue":"cs.CR","work_id":"193d98f2-c913-4d0c-814e-b550a64bd03c","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2504.11703","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:7a0a6e750bed4e92850de2685c7c8e0c120c84c0b27a148b574615208b536a68","observation_id":"adcf6bab-1648-43c3-9144-baaf690bee4b","resolution":{"observed_at":"2026-07-03T06:17:41.933633Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-02T11:48:17.206729Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":"2404.13208","doi":"10.48550/arxiv.2404.13208","metadata_source":"pith","pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","venue":"cs.CR","work_id":"ba941a96-eb3b-48c0-b52c-5e9463085190","year":2024},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:2b9a0b578f8bbe29e5221d2ca2a199906241957e8efb3931a66a48ee4b6d2831","observation_id":"4d2b9350-639a-4886-8b75-7ecdc24e3c81","resolution":{"observed_at":"2026-07-03T06:17:41.930639Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.19207","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T06:59:37.761424Z","title":"https://doi.org/10","venue":null,"work_id":"0729225a-cf6c-457c-a346-15bc7e176227","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:4c507e24264758eb789d7d3b50b7de6b935574044251572493567ba98e57ebb3","observation_id":"56f0bc90-04e7-4d49-8d53-4db78cc3e317","resolution":{"observed_at":"2026-07-03T06:17:41.893714Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-07-06T21:21:20.149404Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:4144db47bfe1403fa47b5ebfbc78f18dd4caf78a228deac429da8e84464bdac9","observation_id":"412cde2d-a5bb-4fc3-bbf5-52bb12fd7d8a","resolution":{"observed_at":"2026-07-03T06:17:41.945423Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:7a4c248dcd54b7a8e91e0a0bfcc8f5c4b279f43baf20ec34c6c4c84aa96e76f1","observation_id":"6bcc2151-383c-4332-8efe-494d9f1e9bc8","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.19091","last_updated":"2024-10-10T15:29:07Z","snapshot_observed_at":"2026-07-06T19:23:37.758078Z","submitted_at":"2024-09-27T18:41:58Z","title":"System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective","version":2},"cited_work":{"arxiv_id":"2409.19091","doi":null,"metadata_source":"pith","pith_arxiv_id":"2409.19091","snapshot_observed_at":"2026-07-10T12:27:04.230184Z","title":"System-level defense against indirect prompt injection attacks: An information flow control perspective","venue":"cs.CR","work_id":"c3786d6b-d1c5-4d79-af2c-1215479ed680","year":2024},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2409.19091","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:6d81e9e2a115e590cd04fde9e1f8dce9154388aeda18553a7b51d21c7be1630d","observation_id":"5e8bc831-6b73-4c07-ab03-1962a5f8371b","resolution":{"observed_at":"2026-07-03T06:17:41.905749Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.09102","last_updated":"2025-03-01T19:06:35Z","snapshot_observed_at":"2026-08-04T17:29:52.046121Z","submitted_at":"2024-10-09T12:52:41Z","title":"Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchy","version":2},"cited_work":{"arxiv_id":"2410.09102","doi":"10.48550/arxiv.2410.09102","metadata_source":"arxiv_reference","pith_arxiv_id":"2410.09102","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchy","venue":"arXiv (Cornell University)","work_id":"8ce36bb7-e2e5-4b6b-b2eb-4ddea0c841ce","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2410.09102","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:a1381e67b8d38449ca74b465d12a7ec6c1f33ca1b0390bd6a63ef7f5fb577d26","observation_id":"cecd6181-85a9-455b-a630-d3d62fb60e05","resolution":{"observed_at":"2026-07-03T06:17:41.878883Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:3e917b16c896cc4506966a5a418cfdc6055289cd8dc8ce115b49c1d19247c2e2","observation_id":"cef3c106-1b6a-4445-abf4-79ecc87dd069","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":"InNetwork and Distributed System Security (NDSS) Symposium","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:ce0861ce3f72507f0ddd7015007f29aa3863c51267d947843fb00df6f71bc552","observation_id":"781b7d30-9e9f-4625-9836-57e222daef37","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1007/s11432-024-4222-0","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"The rise and potential of large language model based agents: a survey.Sci","venue":"Science China Information Sciences","work_id":"9e61dda9-2432-40e6-a7e6-12a19f97b548","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:947bee80526f1ca984b78c6da635276cea22e8eb3a32e0736b693fa1fffeee8e","observation_id":"953d2702-ab30-4afe-85d9-b7a1cd92ca12","resolution":{"observed_at":"2026-06-27T12:50:55.668211Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-07-15T19:20:36.01722+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T19:20:36.01722+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.09388","last_updated":"2025-05-14T13:41:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-05-14T13:41:34Z","title":"Qwen3 Technical Report","version":1},"cited_work":{"arxiv_id":"2505.09388","doi":"10.1016/j.aiopen.2022.12","metadata_source":"pith","pith_arxiv_id":"2505.09388","snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"Qwen3 Technical Report","venue":"cs.CL","work_id":"25a4e30c-1232-48e7-9925-02fa12ba7c9e","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2505.09388","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:1580a53d99a643d8c6cd6c29623bb923368ded3cda73d079d3f8d8afce70a847","observation_id":"5fdb94a6-5a64-4702-b374-2c10410c8a18","resolution":{"observed_at":"2026-07-03T06:17:41.876385Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2505.15738","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-03T06:17:41.879961Z","title":"Align- ment under pressure: The case for informed adver- saries when evaluating llm defenses","venue":null,"work_id":"7e6e2ba4-d6c0-4808-9e13-bae37e87c255","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:124825e0a436c3224f7603411fe0b93cf691d6e11827297f1a6080eed6a03a6a","observation_id":"6b9709cd-e6fb-4490-84c9-7de61a943015","resolution":{"observed_at":"2026-07-03T06:17:41.881445Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:9f23ad8b2c17f84809324bdccf06f95a017ff0a9d489935ec6a05615d3cd2036","observation_id":"a01fee04-b7c9-4f58-b529-93d3b7eaee0f","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"0624.370917","doi":"10.1145/3690624.3709171","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.1 , pages =","venue":null,"work_id":"70d41772-c3cc-43c9-9c0c-df56285f9e0b","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:0d591b2b8ad2ca4ffc02199fcb829bf40df029ec448f7357142e54be941dcf21","observation_id":"8cd79802-fef0-43b2-bd91-eedd15cb25ce","resolution":{"observed_at":"2026-06-27T12:50:55.662337Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.18653/v1/2025.findings-","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-02T12:56:56.427813Z","title":"scrolling screenshot","venue":null,"work_id":"fb1fd69b-c861-4305-bb30-5d5724449942","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:022bb7f65a47b99a02a2af5c545e9ed5fe636e05124c0c7e18b8f0c20f2af7c4","observation_id":"eee81a4c-cb9d-4310-b26c-483246ef7e9f","resolution":{"observed_at":"2026-06-27T12:50:55.673204Z","resolver_source":"doi_truncated","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.18653/v1/","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:17:03.600265Z","title":"In: Zong, C., Xia, F., Li, W., Navigli, R","venue":null,"work_id":"8d675bdd-79ca-48d6-9163-fc17ce0e8ece","year":2024},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:a0668a6ad50bbb0a47a226ff0203cef806ea576d4fa7b902134768589cca9a7a","observation_id":"844c3d3e-c593-4552-8f5f-a6c9ae4b097d","resolution":{"observed_at":"2026-06-27T12:50:55.664837Z","resolver_source":"doi_truncated","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.22724","doi":"10.48550/arxiv.2602.22724","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Agentsentry: Mitigating indirect prompt injection in llm agents via temporal causal diagnostics and context purification","venue":"Open MIND","work_id":"f201b9d8-52ac-4a3f-888c-e488c65bc313","year":2026},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:b3af1d6bdf41659f3586ffc56fa9ae253785ae242bfd45ff1a0260167589ed0b","observation_id":"6d0b9b79-250c-4f5a-85fe-a20a1e1e19b7","resolution":{"observed_at":"2026-07-03T06:17:41.874042Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-06T02:50:59.595995Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:1c532230b13019039afb872d08e9d5a0a752e90a43ecae63f6aec0abb3baffdc","observation_id":"23bc665b-1513-4c67-8076-ab33edaecd18","resolution":{"observed_at":"2026-07-03T06:17:41.876038Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":"2307.15043","doi":"10.48550/arxiv.2307.15043","metadata_source":"pith","pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","venue":"cs.CL","work_id":"3322fa86-1768-4677-8425-dd326b45e078","year":2023},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:8a9cdb80794004dccd74fe4f670cbcef08b2a13ac66b58fce4c29bdab855d523","observation_id":"e6297b21-717f-4ad1-9c61-2696e2fe86ce","resolution":{"observed_at":"2026-07-03T06:17:41.866185Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-07-15T23:50:40.271168+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T23:50:40.271168+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:074d0be19c272b026e579154a49b65b36e54cd248bb4dc2bba0d06e5a6c95d03","observation_id":"5f931fcc-b6b6-407c-8a16-1428f067818c","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2503.10566","doi":"10.48550/arxiv.2503.10566","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"attacker goals","venue":"arXiv (Cornell University)","work_id":"508a5621-8a4c-4da4-aee8-e5ac6e333d63","year":2026},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:86df6267627f3eaf58fabd6663cc42b4dab6bd7013d830d18add79edc2e5d08c","observation_id":"99f0b189-84c0-408d-80d4-78713be86b05","resolution":{"observed_at":"2026-07-03T06:17:41.951974Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:0dc0ff652349160d821b42f59ae32f2ac2457659c6e63ff857311bdddb187455","observation_id":"459a8f6a-6c32-4349-a37d-3c9af55680c6","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:83dfe7543cc8a8e3556a498ae1686b30e092f45a021d4a0f17271bfbffa6b53b","observation_id":"a9c54ebc-9677-4043-bd78-df150935d3af","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":"[SYSTEM OVERRIDE]","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:65e3a27b0b669226fdd197761e6777f24ff7873f79ea6c9a2b7492a5818083ed","observation_id":"8f66e165-a617-4c3a-9929-c8b0e50c3e06","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:666426cbe74872a7fc984e56a7876c4311e627f0e3ee349152b474bab75ca158","observation_id":"9930f064-7082-48ed-bc83-5f9f8db30951","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:1db347cd7a564fb92fb57d7a75f34902258ff187731820e0ba490dc247a70fab","observation_id":"0b84a063-2a97-4256-b3ad-120945476152","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T12:47:09.467463Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:2a7f3b88f54f7c72aedccdb1a869a01ca1bbd32aac6179075d5f3f3825ac763b","observation_id":"4b8baf16-e2ef-47e9-b781-c0a8d4613c76","resolution":{"observed_at":"2026-06-27T12:47:09.467463Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments"},"reference_resolution":{"displayed":67,"state_counts":{"malformed_identifier":2,"metadata_mismatch":7,"parse_uncertain":0,"unresolved":25,"verified_exact":33,"verified_fuzzy":0},"total_outbound_references":67},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"thesis":"As of 6 August 2026, this Paper Citation Record lists 67 of 67 outbound references and 0 inbound Pith citation observations for arXiv:2606.10525."}