{"as_of":"2026-08-07T18:52:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:7377811a483c19c4a8f7ab9e59cdb449aa80fccfc487fb1279e0113730bd920e","coverage":[{"denominator":27,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":27,"source":"paper_references, paper_reference_links","source_observed_at":"2026-06-26T14:02:37.404821Z","state":"measured"},{"denominator":27,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":27,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-07T06:34:17.273281+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2606.21071/citation-record","integrity":"/paper/2606.21071/integrity","json":"/paper/2606.21071/citation-record.json","paper":"/paper/2606.21071"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2507.09063","last_updated":"2025-07-11T22:45:07Z","snapshot_observed_at":"2026-08-06T18:02:57.107843Z","submitted_at":"2025-07-11T22:45:07Z","title":"SetupBench: Assessing Software Engineering Agents' Ability to Bootstrap Development Environments","version":1},"cited_work":{"arxiv_id":"2507.09063","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2507.09063","snapshot_observed_at":"2026-07-04T06:59:37.262688Z","title":"Setupbench: Assessing software engineering agents’ ability to bootstrap development environments","venue":null,"work_id":"db3dc07a-47e6-4f8a-9da7-0a5ad98429ad","year":2025},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"cited_paper":"/paper/2507.09063","citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:90cb4db74259cf41ed6533a94054fe2b8d691771bc27cc7c690b5804be62a2cb","observation_id":"019662f6-356d-4c7d-9f4c-df963549c716","resolution":{"observed_at":"2026-07-04T06:59:37.264275Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"ToxicSkills: Snyk Finds Malware and Prompt Injection in 36% of AI Agent Skills","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:8619e8abaac440bd24af2d7a5cfe5b15ccf34b01e38616b01cbce6104ccc0007","observation_id":"e9a098f6-2d4e-4046-81a6-2bf4aa5052ec","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"280+ leaky skills: How openclaw & clawhub are exposing api keys and pii.Snyk Blog, February, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:c51a2eaf57b55b3520900c964879097b865dbcf8d0e9b21aad04cc3bd092bb8f","observation_id":"824aaf42-b950-4617-b782-d80a3af81cb0","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.28588","last_updated":"2026-05-27T15:10:10Z","snapshot_observed_at":"2026-08-01T04:54:18.636366Z","submitted_at":"2026-05-27T15:10:10Z","title":"Technical Report: Exploring the Emerging Threats of the Agent Skill Ecosystem","version":1},"cited_work":{"arxiv_id":"2605.28588","doi":null,"metadata_source":"pith","pith_arxiv_id":"2605.28588","snapshot_observed_at":"2026-07-04T06:59:37.263500Z","title":"Technical Report: Exploring the Emerging Threats of the Agent Skill Ecosystem","venue":"cs.CR","work_id":"0a9058c5-b1c0-4172-bdbb-0661eab8cb23","year":2026},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"cited_paper":"/paper/2605.28588","citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:d7553b2e1f0859d797f00e51afc3a4ffb8d90bc2d47d50691d26ed0fbc9237ba","observation_id":"09f56075-0c82-46aa-b636-b10c44a023ef","resolution":{"observed_at":"2026-07-04T06:59:37.264746Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"Openclaw security: Risks of exposed ai agents explained","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:c1bef29537406ab0862144a1875edf34215031add806cd1ec4f45ee222debad0","observation_id":"3afedd35-fea4-459a-9a8f-74b07e096176","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2509.22830","last_updated":"2026-04-13T15:36:16Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-09-26T18:38:07Z","title":"ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents","version":3},"cited_work":{"arxiv_id":"2509.22830","doi":"10.48550/arxiv.2509.22830","metadata_source":"pith","pith_arxiv_id":"2509.22830","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents","venue":"cs.CL","work_id":"637eeddc-84ed-44f0-b65b-cc50f538421b","year":2025},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"cited_paper":"/paper/2509.22830","citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:d8ad1f532bf70501f50fe7e96ce786fa122d6f01cef435960432fa6ff6ef270c","observation_id":"c7277061-3e7f-485a-a2d9-cfa3a903c988","resolution":{"observed_at":"2026-07-04T06:59:37.267265Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"Securing the Agent Skill Ecosystem: How Snyk and Vercel Are Protecting Developers","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:90c2e41305d6fc06c1a8a1becb7fa3ad0b883088b2feca00847a57f97a169ffc","observation_id":"4ed6cf14-c911-4fa1-8538-70f4205b288c","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"CodeQL: Semantic code analysis engine","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:4b54f667a77984410deaedb3853912c4118ece033075965f61e3534669a9f174","observation_id":"7cf3d34d-7278-4152-8f4d-a1b7ac659f0a","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"GitHub advisory database","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:352b25080fd1a168f5233ed1393a98cf6373ae66b18c137ed2fba560c69534e5","observation_id":"707cbe84-9e01-42c1-b92c-be57e93fdc88","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:209ac3098f1d9e55e9561876ae89b16dadad7ab686e51d31326ba0198c400270","observation_id":"2277738f-5fa9-49d2-a86e-5bcf285c68c8","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.13538","last_updated":"2026-04-13T03:45:24Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-06-16T14:26:37Z","title":"Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers","version":5},"cited_work":{"arxiv_id":"2506.13538","doi":"10.48550/arxiv.2506.13538","metadata_source":"pith","pith_arxiv_id":"2506.13538","snapshot_observed_at":"2026-07-11T02:47:50.715137Z","title":"Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers","venue":"cs.SE","work_id":"c7825b29-3cba-435a-a713-36c73899e542","year":2025},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"cited_paper":"/paper/2506.13538","citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:f2ad8558c4b90821bc7711f53d0a98fd8d55f4d2b5c25d1621b3ffa19ef81ee8","observation_id":"7c934dd6-fdc9-41f0-9797-6aedd96d5596","resolution":{"observed_at":"2026-07-04T06:59:37.270067Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"Nanobot: Lightweight, open-source AI agent for tools, chats, and workflows","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:3009ac0190a61e918347c254f2d9ac0334227471ec97f41af5dc89f0c301fac4","observation_id":"3114db95-5a8d-418a-89db-b3f908c4ea43","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"ClawHavoc: 341 malicious clawed skills found by the bot they were targeting, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:b19202c5fe898632989562fb55d63135024b51d2da59c77a84f5bb5d70207441","observation_id":"bbeb1ed0-db20-44ee-bca8-bdbb25d790e5","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"LangChain, October 2022","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:f50475bb38786413d537231f14acecd0703dc62afbcb3708a925e1785e08ccce","observation_id":"cf6bff4c-ab25-4bea-9f18-98a8466c8233","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"LlamaIndex, 11 2022.https://github.com/jerryjliu/llama_index","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:e30da6272a3b737bb09ae2abfda99e4e97f947e95ee53bd28132c479b39cb595","observation_id":"0b9ce34b-ddb7-42e8-ab07-625eb0fb5f4b","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2601.10338","last_updated":"2026-01-15T12:31:52Z","snapshot_observed_at":"2026-07-06T22:41:48.115083Z","submitted_at":"2026-01-15T12:31:52Z","title":"Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale","version":1},"cited_work":{"arxiv_id":"2601.10338","doi":"10.48550/arxiv.2601.10338","metadata_source":"pith","pith_arxiv_id":"2601.10338","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale","venue":"cs.CR","work_id":"0780d782-7977-4d63-a1f2-3ae587a49c98","year":2026},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"cited_paper":"/paper/2601.10338","citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:174edecc4cd646fb5764537fe5219787ee3862a7376af1a8a74f21cc769cd7c5","observation_id":"f751aa14-e6cc-401f-a040-2f8c13857835","resolution":{"observed_at":"2026-07-04T06:59:37.262364Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"The STRIDE threat model","venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:d621514c5bc4d89982a55a2ae89a7ffeecc1e484ed22183abf9bb585fce9375c","observation_id":"128aba34-8d80-40a0-b3a9-99ad81da5c02","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"Evaluating and comparing memory error vulnerability detectors.Information and Software Technology, 137:106614, 2021","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:86a6aa04063b5856c0f0a9fb5f9f3420c52f383d3f608327e82a6f3fd30411da","observation_id":"5f10e442-1ddf-4666-a88a-85e78616c487","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"Open science in software engineering: A study on deep learning-based vulnerability detection.IEEE Transactions on Software Engineering, 49(4):1983–2005, 2022","venue":null,"work_id":null,"year":1983},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:323804fbafa0dfa368da4ca5dc4116a98a8c156e7896a41f81930727933d9921","observation_id":"346f6cb9-549f-4728-b959-2e6c713e2694","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2511.20709","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T06:59:37.258306Z","title":"DualGauge: Automated joint security-functionality benchmarking of specification- only code generation by LLMs and coding agents.arXiv preprint arXiv:2511.20709, 2026","venue":null,"work_id":"df4cd1df-3bca-4ca0-9ed9-d5bfeaddd777","year":2026},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:69dcd7e8ee562804c7d75596bc7cdfb37b3407aeaa49801a0bdc6f39a17caed8","observation_id":"dcff3fbf-be82-4aa8-87d8-a9c875056ec4","resolution":{"observed_at":"2026-07-04T06:59:37.259790Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"Semgrep: Lightweight static analysis for many languages","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:a5687dce92f01f1c00e6b44efff35bb3de0b76fc76d26445ebbc8543ebc8330b","observation_id":"0f63466b-2618-485d-9462-c6e573961489","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:80d2abab3b1735938d34c1d0bda08183a2153cd680725e14c171e7173cc2e55c","observation_id":"145cbb41-cf0c-4e4d-a848-79dfdf4769af","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"parse_uncertain"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"John Wiley & Sons, Indianapolis, IN, 2014","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:b84413824a75c4934d0e2f9d7e643b5c5f26e903bc013a6167dbf43a1d6b410e","observation_id":"914f4cfc-a62a-4241-ba31-f5a0cbaf612d","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"PicoClaw: Tiny, fast, and deployable anywhere — an ultra-lightweight personal AI assistant","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:02a6160874d334594a101e00c579bbe5235d4e98f7d7706ed227ea977031b6d7","observation_id":"c947ef8f-be68-4a17-b7f3-43935a0061c0","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"agent-scan: Security Scanner for AI Agents, MCP Servers, and Agent Skills","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:cb2a3e71a468f0cc64206a07fbfb6079fb4577ba95be410f57b219a1fc2ab85d","observation_id":"344c81f5-c1a9-4aaa-b419-039c393ab2f0","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"OpenClaw: Personal AI assistant","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:783a18f968f5978b769c32ac13f986b95960013a41e1e62260b998a1d8b8103a","observation_id":"e25f391a-4605-4812-aaa1-77b75b958f8c","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T14:02:37.404821Z","title":"CWE-74\"] category:","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-06-26T14:02:37.404821Z"},"links":{"citing_paper":"/paper/2606.21071"},"observation_digest":"sha256:860b38bd5f10d5f48e2e8eb2b00e3ebcde28f397ceac01f2b89b461a71501037","observation_id":"e608bf83-8a07-4490-98ad-67aec3d7dffb","resolution":{"observed_at":"2026-06-26T14:02:37.404821Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2606.21071","last_updated":"2026-06-19T03:40:00Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-06T19:34:26.539767Z","submitted_at":"2026-06-19T03:40:00Z","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer"},"reference_resolution":{"displayed":27,"state_counts":{"malformed_identifier":1,"metadata_mismatch":0,"parse_uncertain":1,"unresolved":19,"verified_exact":6,"verified_fuzzy":0},"total_outbound_references":27},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"thesis":"As of 7 August 2026, this Paper Citation Record lists 27 of 27 outbound references and 0 inbound Pith citation observations for arXiv:2606.21071."}