{"as_of":"2026-08-11T14:10:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:afdb93059b936faf0c1b05955bf229ea4b551a42c1ebe1bfc9229653775fd08a","coverage":[{"denominator":42,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":42,"source":"paper_references, paper_reference_links","source_observed_at":"2026-06-27T06:20:04.789341Z","state":"measured"},{"denominator":42,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":42,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-11T06:34:44.6726+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2606.13385/citation-record","integrity":"/paper/2606.13385/integrity","json":"/paper/2606.13385/citation-record.json","paper":"/paper/2606.13385"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:d435ce83dbb77f875b10dcc408b00d3523d3b192d109dad4413b8b3fb314e59f","observation_id":"a5d5d9a8-a372-4c72-981d-e893a004a023","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:7def3e2c19391676ee3fb9d203eb33f8df697bd8f77ba94e759622d023d5e1ef","observation_id":"2cdcf74c-44f1-43cc-a843-76d53ef790bf","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:215560988791f5b78bbe2c0491ce74390380e227fa6374effdfe137e72fa93c4","observation_id":"2574e85c-ee2b-42b3-847c-e127e638e12f","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":"Zheng, B","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:8561c4c3450d35fd60a8b31708d893c5ed1cb6b4ae90581fc5ca30e5a54b042f","observation_id":"84058bde-abdd-46c2-9f70-e575f69f105c","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:339ed89391c607a2d2e2b1de71d3c9155482de09f59a850cfb52d1a9cfcf6f4f","observation_id":"e2a1b1ae-6fff-490e-b9e5-c29ff0ae78ae","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:c2ae71159a5a9f1eb5423bd51ca8376c64a86d77862a5c9c65548c7d9be9f62b","observation_id":"e59577a3-d92b-4562-bfdd-d95e7ac31123","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2211.09527","last_updated":"2022-11-17T13:43:20Z","snapshot_observed_at":"2026-07-06T14:19:47.424778Z","submitted_at":"2022-11-17T13:43:20Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","version":1},"cited_work":{"arxiv_id":"2211.09527","doi":"10.48550/arxiv.2211.09527","metadata_source":"pith","pith_arxiv_id":"2211.09527","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","venue":"cs.CL","work_id":"a7c5b6ec-3407-4330-96c8-3fc58e7d410b","year":2022},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2211.09527","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:2e7d466de61886596a0aa2a20d32a204b93a7e1ee2309096aaea3117ea53a1cc","observation_id":"4e322c11-3acb-4d0e-a7b4-cee20401cb7b","resolution":{"observed_at":"2026-07-03T15:48:35.872170Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-05-24T11:53:03.018758+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-24T11:53:03.018758+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:75e6a1cfd80c14c73aa1849b4d6a1fc3067697e11059be09d5e65bea736a4296","observation_id":"bdb17c56-6f85-453d-b0dc-b71d1c37209b","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:1a71c6a926247ce4e14ee33e9ca7354d0043e86f1456fb155e96e8e0432ee41e","observation_id":"932c5dea-7d2c-4be0-a881-d4c57d4108f2","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:87ae03a69e1e23053be03df95d34d1488acd6e2da55af5c2c62d4950922fe9e0","observation_id":"d6774961-b2fd-4818-b864-9ee8b0cdb829","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.26328","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-03T15:48:35.870152Z","title":"Agent skills enable a new class of realis- tic and trivially simple prompt injections","venue":null,"work_id":"8dfc4a7d-02a6-4eb8-9562-49d4fcee1395","year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:634fd834494cca862a2aa809f7ee5fd10191b36eaf34e375986f7779916462b9","observation_id":"932db100-12dd-425c-9f95-22a10706fbb2","resolution":{"observed_at":"2026-07-03T15:48:35.871466Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":"2502.08586","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-07-03T15:48:35.883148Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks","venue":null,"work_id":"5cfa141e-b5d8-4c19-bc39-255d473ea954","year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:79bcfc2e911a8fcded63db1dab82d2436a6ad27b11412ed8617f1d54d515efd1","observation_id":"feca9d20-b067-4135-afa2-fb5e6e604f1d","resolution":{"observed_at":"2026-07-03T15:48:35.884551Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.15817","last_updated":"2024-05-17T17:17:45Z","snapshot_observed_at":"2026-07-06T16:24:30.545494Z","submitted_at":"2023-09-25T17:08:02Z","title":"Identifying the Risks of LM Agents with an LM-Emulated Sandbox","version":2},"cited_work":{"arxiv_id":"2309.15817","doi":"10.48550/arxiv.2309.15817","metadata_source":"pith","pith_arxiv_id":"2309.15817","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Identifying the Risks of LM Agents with an LM-Emulated Sandbox","venue":"cs.AI","work_id":"3d4c3b66-d749-4939-b1bc-62b10b2ebbb6","year":2023},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2309.15817","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:ff0636b32aa12f964e93131086156b5f941866b19434aa09165b244938859a24","observation_id":"89d15486-efc0-42b6-9f53-cec4f30be0cf","resolution":{"observed_at":"2026-07-03T15:48:35.866785Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.01055","last_updated":"2025-06-01T15:48:06Z","snapshot_observed_at":"2026-08-09T00:34:14.908419Z","submitted_at":"2025-06-01T15:48:06Z","title":"Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution","version":1},"cited_work":{"arxiv_id":"2506.01055","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2506.01055","snapshot_observed_at":"2026-07-04T14:09:53.274632Z","title":"Simple prompt injection attacks can leak personal data observed by llm agents during task execution","venue":null,"work_id":"0f88bb16-d6ed-41c4-8b0b-49b456b6d51e","year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2506.01055","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:a981f0196aaeedfe2b14c9d886712cb6cacb7caa43ac4089c030736201b9d6e8","observation_id":"5649493c-6fb9-4c0a-99c3-fd1d0f6f4ac0","resolution":{"observed_at":"2026-07-03T15:48:35.889462Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.17934","last_updated":"2025-06-05T12:40:53Z","snapshot_observed_at":"2026-08-07T15:59:22.482288Z","submitted_at":"2025-04-24T20:51:20Z","title":"Toward a Human-Centered Evaluation Framework for Trustworthy LLM-Powered GUI Agents","version":2},"cited_work":{"arxiv_id":"2504.17934","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2504.17934","snapshot_observed_at":"2026-07-03T15:48:35.875788Z","title":null,"venue":null,"work_id":"ed9496fc-a6e0-4a88-8cae-85b890d44d2c","year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2504.17934","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:80257318cc0da83fa9670d8091085e379844ef514d1afa6a2c0f625225c1bd9f","observation_id":"a21e458c-fd05-4bf8-ba53-82387161c6db","resolution":{"observed_at":"2026-07-03T15:48:35.877012Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.02644","last_updated":"2025-05-30T03:50:33Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-10-03T16:30:47Z","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","version":4},"cited_work":{"arxiv_id":"2410.02644","doi":"10.48550/arxiv.2410.02644","metadata_source":"pith","pith_arxiv_id":"2410.02644","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","venue":"cs.CR","work_id":"15ab4a69-85ab-4295-839d-080a2cd3e7aa","year":2024},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2410.02644","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:bb85592de225b0a73f87a83663ea19692214bb718a9516d24991df5b58a9bed4","observation_id":"6ac1b8d2-3149-4362-adf8-b998fb7df876","resolution":{"observed_at":"2026-07-03T15:48:35.862017Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:8d1ebb59cfbc22b46de0e1982e2c4c8d106fb851ab3f667dda2b6a4bf5565b6b","observation_id":"7a7d5677-42de-4852-adc9-ef8a4336dca5","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.06703","last_updated":"2026-06-04T09:59:28Z","snapshot_observed_at":"2026-08-05T07:12:18.604381Z","submitted_at":"2024-10-09T09:13:38Z","title":"ST-WebAgentBench: A Benchmark for Evaluating Safety and Trustworthiness in Web Agents","version":7},"cited_work":{"arxiv_id":"2410.06703","doi":"10.48550/arxiv.2410.06703","metadata_source":"pith","pith_arxiv_id":"2410.06703","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"St- webagentbench: A benchmark for evaluating safety and trustworthiness in web agents","venue":"cs.AI","work_id":"02dc69db-8db6-48b1-ac24-4004642dfa94","year":2024},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2410.06703","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:36733c7b86232ca0723b6537522fba99d02e30d628a538fc6889cf3cf6909686","observation_id":"1b0591c1-fdaa-4674-b416-0a49f369a43f","resolution":{"observed_at":"2026-07-03T15:48:35.887057Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2602.03117","last_updated":"2026-05-07T07:42:14Z","snapshot_observed_at":"2026-08-11T09:34:15.482986Z","submitted_at":"2026-02-03T05:20:42Z","title":"AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?","version":3},"cited_work":{"arxiv_id":"2602.03117","doi":"10.48550/arxiv.2602.03117","metadata_source":"pith","pith_arxiv_id":"2602.03117","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?","venue":"cs.CR","work_id":"5164f177-b5ab-4d9c-ac93-125e92bf1f5a","year":2026},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2602.03117","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:9288c577021c79997e690c371795cd2454e467361bf3369ddb594ee16ac45ccf","observation_id":"4e304293-76e4-4bef-8d54-476547156fff","resolution":{"observed_at":"2026-07-03T15:48:35.874723Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-07-15T19:20:23.920036+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T19:20:23.920036+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2511.05797","doi":"10.48550/arxiv.2511.05797","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"When ai meets the web: Prompt injection risks in third-party ai chatbot plugins","venue":"arXiv (Cornell University)","work_id":"45bc4278-a1cd-463d-b471-cd555cee6c10","year":2026},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:2e4ec2fa125893b8ea02efdc460c55ba813fe3fd765c73bd112eafc29d39bf29","observation_id":"6881cd78-dcdb-4fb2-8321-c269600d4ee9","resolution":{"observed_at":"2026-07-03T15:48:35.869731Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02839","last_updated":"2025-06-03T13:08:17Z","snapshot_observed_at":"2026-08-11T09:56:50.892544Z","submitted_at":"2025-06-03T13:08:17Z","title":"DeepShop: A Benchmark for Deep Research Shopping Agents","version":1},"cited_work":{"arxiv_id":"2506.02839","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2506.02839","snapshot_observed_at":"2026-07-03T15:48:35.852951Z","title":"Deepshop: A benchmark for deep research shopping agents","venue":null,"work_id":"fbbb47e3-1dac-4aaf-a4d0-ed74d7d9bc3a","year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2506.02839","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:1a6d1f5664342e969447a71c8f2b2031b163b1fd3bc38686b415f79dba3e3a86","observation_id":"d7b860bd-8f5b-4709-86aa-4511ee66deb3","resolution":{"observed_at":"2026-07-03T15:48:35.854474Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:b1d2d2e1c036c0195cff93b79fbb0905fd9ab666f31293303b2e34e414015871","observation_id":"a9455e81-67bc-4528-85e6-2190f6d19e18","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2210.03629","last_updated":"2023-03-10T01:00:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-10-06T01:00:32Z","title":"ReAct: Synergizing Reasoning and Acting in Language Models","version":3},"cited_work":{"arxiv_id":"2210.03629","doi":"10.48550/arxiv.2210.03629","metadata_source":"pith","pith_arxiv_id":"2210.03629","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"ReAct: Synergizing Reasoning and Acting in Language Models","venue":"cs.CL","work_id":"407a2351-25f1-497d-b611-f77d0292a8e6","year":2022},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2210.03629","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:c6296b1a9fe03ae87d31fd26a544838df924468cb6a4c6fa76f0a3a3686db673","observation_id":"1a4d57e5-2e25-4446-a9b9-08e7d43a8b95","resolution":{"observed_at":"2026-07-03T15:48:35.876358Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-07-12T03:19:36.897515+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-12T03:19:36.897515+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:367727763423d749d7e1229060b4939b68daf45b872f32e4bb23a6f78207302f","observation_id":"bebd4911-be81-46f7-a833-382a4accfa43","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.18575","last_updated":"2025-05-16T22:42:29Z","snapshot_observed_at":"2026-08-10T18:17:57.457186Z","submitted_at":"2025-04-22T17:51:03Z","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","version":3},"cited_work":{"arxiv_id":"2504.18575","doi":"10.48550/arxiv.2504.18575","metadata_source":"pith","pith_arxiv_id":"2504.18575","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","venue":"cs.CR","work_id":"bf1914b2-fd32-4768-a4d5-84720606d71b","year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2504.18575","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:1518bcffdc8c081e9ab9b61f33d4132b6ce8dc0c8da072aeb3875e4b2cf42686","observation_id":"2d6bc6a3-6e4f-45ef-b340-92634f7ca883","resolution":{"observed_at":"2026-07-03T15:48:35.882057Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.12856","last_updated":"2024-02-25T16:17:43Z","snapshot_observed_at":"2026-07-06T15:57:53.178833Z","submitted_at":"2023-07-24T14:56:30Z","title":"A Real-World WebAgent with Planning, Long Context Understanding, and Program Synthesis","version":4},"cited_work":{"arxiv_id":"2307.12856","doi":"10.48550/arxiv.2307.12856","metadata_source":"pith","pith_arxiv_id":"2307.12856","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"A Real-World WebAgent with Planning, Long Context Understanding, and Program Synthesis","venue":"cs.LG","work_id":"0915d1fc-bc46-4128-871e-f9233dca44b6","year":2023},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2307.12856","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:c9fac44f889b167589cb114757ebf8a1b37d13025b67901550ec84e9a1b77803","observation_id":"964f32a0-2771-46da-bce4-0f5fcbe2ee67","resolution":{"observed_at":"2026-07-03T15:48:35.839441Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:4a0c04d21e4ad459dd8a5979f290c0562d36ada6b6af12d5c8d7e2867c56a294","observation_id":"dbe77841-d356-43a0-8650-63e14caaef1c","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":"Greshake, S","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:dfea46942de84343d872f1418ffca9a31492989a737dc231f029b71dd53d1a93","observation_id":"391980d0-3530-4548-b706-a364ae10fb7e","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.19793","last_updated":"2025-08-24T03:28:21Z","snapshot_observed_at":"2026-08-01T07:24:09.967062Z","submitted_at":"2025-04-28T13:36:43Z","title":"Prompt Injection Attack to Tool Selection in LLM Agents","version":3},"cited_work":{"arxiv_id":"2504.19793","doi":"10.48550/arxiv.2504.19793","metadata_source":"pith","pith_arxiv_id":"2504.19793","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Prompt Injection Attack to Tool Selection in LLM Agents","venue":"cs.CR","work_id":"0224da95-0f8f-4479-bb4e-602bec01d31c","year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2504.19793","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:0528b1ce1779e1fe3156f0ec465b983bfa7c3ff4ef3f5120b4306a8f18a66e9a","observation_id":"7032f6e5-119e-42db-8f6d-d331ad0a39d6","resolution":{"observed_at":"2026-07-03T15:48:35.839231Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.10453","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T13:39:51.337137Z","title":"arXiv preprint arXiv:2602.10453 , year=","venue":null,"work_id":"16c524eb-7f93-4bcc-bcb4-d30238f9c00a","year":2026},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:390715f2b51cd311388345dccaabd7d2498a9014ea669ba54602d30e3b69117b","observation_id":"324a9997-05b4-47e4-bbf3-1103c7cc25ba","resolution":{"observed_at":"2026-07-03T15:48:35.841681Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2503.09780","doi":"10.48550/arxiv.2503.09780","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Agentdam: Privacy leakage evaluation for autonomous web agents","venue":"ArXiv.org","work_id":"25d4c9f1-6b12-41cd-abf1-88d531ebe044","year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:305ce6af9ba42f2f89cf59d5feed66e9bc2f7b33b0775b1356492bd18da4782c","observation_id":"2a182045-cd18-4642-ab45-61bc7a646b1a","resolution":{"observed_at":"2026-07-03T15:48:35.851858Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2506.14866","doi":"10.48550/arxiv.2506.14866","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Os-harm: A benchmark for measuring safety of computer use agents","venue":"ArXiv.org","work_id":"e83d917b-c8de-475a-9fdd-0a1c334de498","year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:dab3df044a73bb415a543a6f34286ee7a79d53a9952ecebf43836b01191ff47a","observation_id":"d67f0b93-7014-4a46-a52a-daa165c2575f","resolution":{"observed_at":"2026-07-03T15:48:35.857190Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:ad0eab4a6d0ea6a3b817d2aba9b4e9cf13f367965bae105a986f7a8f6224d8b6","observation_id":"f55c4194-4fdc-45b9-a517-bfcd0fd8a33a","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":"Debenedetti, J","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:e30af8afe6b0fbc3cca6369c0caef42ab43480e9ed8176280088b16ba80fcc6a","observation_id":"47eea026-877a-471c-b005-96cd06cbc16a","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.09222","doi":"10.48550/arxiv.2602.09222","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Muzzle: Adaptive agentic red-teaming of web agents against indirect prompt injection attacks","venue":"Open MIND","work_id":"4d2527e1-2167-4813-a66a-6b86ed646102","year":2026},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:9a5c65616c842a644d19a11bf49b8e975981b4d971284490e016e3ab0524c134","observation_id":"ae28ef6e-c7e0-43e4-bac7-60e3e5c919e2","resolution":{"observed_at":"2026-07-03T15:48:35.850791Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:5e5050f8589524dec1d6cf4288be57eba7736060b6123823cf04424991fce9b8","observation_id":"4c0fd225-4075-4993-bdc6-d4979a9bdaf8","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:529429eeb6145e51944ad85cdbd6e26a39852280be06cdf3f14643f5dc396509","observation_id":"67cf293c-2fb8-4f11-b524-760478c2ea2c","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2601.03267","last_updated":"2026-05-01T23:55:43Z","snapshot_observed_at":"2026-08-02T10:52:10.211700Z","submitted_at":"2025-12-19T07:05:38Z","title":"OpenAI GPT-5 System Card","version":2},"cited_work":{"arxiv_id":"2601.03267","doi":"10.48550/arxiv.2601.03267","metadata_source":"pith","pith_arxiv_id":"2601.03267","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"OpenAI GPT-5 System Card","venue":"cs.CL","work_id":"ca87689a-0d29-4476-b504-b65dbbb08af4","year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2601.03267","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:47e339703d9d4a4eb8fe5d11dd805188405b3fca016e9fc821996b3ba162b0ac","observation_id":"aeb698de-98e8-480b-9b20-8dfe3bd6cdab","resolution":{"observed_at":"2026-07-03T15:48:35.879733Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-10T00:38:24.809631+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-10T00:38:24.809631+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2507.06261","last_updated":"2025-12-19T14:25:46Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-07-07T17:36:04Z","title":"Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities","version":6},"cited_work":{"arxiv_id":"2507.06261","doi":"10.48550/arxiv.2503.19","metadata_source":"pith","pith_arxiv_id":"2507.06261","snapshot_observed_at":"2026-07-11T03:17:51.364436Z","title":"Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities","venue":"cs.CL","work_id":"008df105-2fdd-45d8-857a-8e35868aecb6","year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2507.06261","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:b141ee579d492c2e822863c12dbfa09bce6971a29a1f852a08d92bc765015d53","observation_id":"4c3f2ec1-1149-40ed-a327-bffe52f74b6b","resolution":{"observed_at":"2026-07-03T15:48:35.859711Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.12814","last_updated":"2025-02-04T20:02:17Z","snapshot_observed_at":"2026-08-08T10:00:10.515051Z","submitted_at":"2024-06-18T17:32:48Z","title":"Dissecting Adversarial Robustness of Multimodal LM Agents","version":3},"cited_work":{"arxiv_id":"2406.12814","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2406.12814","snapshot_observed_at":"2026-07-04T20:10:08.744897Z","title":"Adversarial at- tacks on multimodal agents","venue":null,"work_id":"67f90b48-268a-4f3e-b70f-f83af2650240","year":2024},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2406.12814","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:455ad5216484e4e475181f8f58540c1230c03b1d88fa94df1b6f3512e742e527","observation_id":"96bad086-12c2-42ba-b5ae-69be35cb8f96","resolution":{"observed_at":"2026-07-03T15:48:35.844469Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-27T06:20:04.789341Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:231d0ffba5effdc54cdd86fa3011d445787521fa87273c435d01d2a7860f1c1a","observation_id":"6707b23c-76b7-4b1e-a20d-10a117570cde","resolution":{"observed_at":"2026-06-27T06:20:04.789341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.13854","last_updated":"2024-04-16T15:13:18Z","snapshot_observed_at":"2026-08-06T12:47:01.809185Z","submitted_at":"2023-07-25T22:59:32Z","title":"WebArena: A Realistic Web Environment for Building Autonomous Agents","version":4},"cited_work":{"arxiv_id":"2307.13854","doi":"10.48550/arxiv.2307.13854","metadata_source":"pith","pith_arxiv_id":"2307.13854","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"WebArena: A Realistic Web Environment for Building Autonomous Agents","venue":"cs.AI","work_id":"7058ffd2-a339-4102-89eb-248eeb074652","year":2023},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2307.13854","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:7c5563118c17780ad834c84bc23493f224e16a518931cb542000b578db76a309","observation_id":"ec4932f7-6021-494a-86eb-1c3333332a4e","resolution":{"observed_at":"2026-07-03T15:48:35.869073Z","resolver_source":"local_arxiv","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-05-20T18:52:18.85917+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-20T18:52:18.85917+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents"},"reference_resolution":{"displayed":42,"state_counts":{"malformed_identifier":1,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":19,"verified_exact":22,"verified_fuzzy":0},"total_outbound_references":42},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"thesis":"As of 11 August 2026, this Paper Citation Record lists 42 of 42 outbound references and 0 inbound Pith citation observations for arXiv:2606.13385."}