{"as_of":"2026-08-17T14:43:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:59ce7a713beb102ef1f1ca63213aaa81aef17803011c31bc1ce20311b0ca9467","coverage":[{"denominator":65,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":65,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-11T08:31:36.099368Z","state":"measured"},{"denominator":66,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":66,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-17T06:30:58.91139+00:00","state":"measured"},{"denominator":1,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":1,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-01T21:47:02.723794Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2607.05120","snapshot_observed_at":"2026-08-01T21:47:02.723794Z","title":"arXiv preprint arXiv:2607.05120 , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.15977","last_updated":"2026-07-17T14:09:01Z","snapshot_observed_at":"2026-08-08T04:41:26.972393Z","submitted_at":"2026-07-17T14:09:01Z","title":"Refusal is Not Safety! Benchmarking Latent Safety Risks of LLM-Driven Content Humorization","version":1},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-01T21:47:02.723794Z"},"links":{"cited_paper":"/paper/2607.05120","citing_paper":"/paper/2607.15977"},"observation_digest":"sha256:97e980bd10aea72765d16931f9feae82d425cbd4680a993632a61b984ad324f7","observation_id":"19955a6f-658c-4b33-a1af-67c02f4b52e5","resolution":{"observed_at":"2026-08-01T21:47:02.723794Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2607.05120/citation-record","integrity":"/paper/2607.05120/integrity","json":"/paper/2607.05120/citation-record.json","paper":"/paper/2607.05120"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Chatgpt,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:4630a663c0796407e6ce8d83bb14ce1490fefa1c5ed09c970f91e1776af29afc","observation_id":"b2ad5205-633a-4304-bb06-898f0114687d","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Claude in chrome,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:6577ebe148412dfb5a00d85f3d3ec32f18e306765f6d79d3f09a0b8d29d1db89","observation_id":"3cdf4264-41b7-4ea4-9348-9ff7faea68bd","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Google gemini cli,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:74428d93aca0764958a4180dcc7acf68c920a71ad88f193119ce6113dc56489c","observation_id":"351f3568-13be-46d0-9267-a3953b926509","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Cross-site scripting (xss) attacks and defense mechanisms: classification and state-of-the-art,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:0d0792ae69d0fb478c96accf73c5d8ff1190b92a2ef1ad96b137afc25810fcb4","observation_id":"97975772-6001-48e1-aec3-0a914974cfd0","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Clarke-Salt,SQL injection attacks and defense","venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:0a693ffdd6920c00e92696dee7421b4ff511402c602622d8da5e0c64a3677a76","observation_id":"3b2be458-3acd-469b-948c-d00a4ccd3913","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Not what you’ve signed up for: Compromising real- world llm-integrated applications with indirect prompt injection,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:e40addfb0b6803da005913be73c3ea531723545f6dc9edcb3ea8a7748a189057","observation_id":"c077783f-db76-4093-989d-96dd4aedb0e2","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05499","last_updated":"2025-12-29T02:25:27Z","snapshot_observed_at":"2026-07-06T15:40:27.639368Z","submitted_at":"2023-06-08T18:43:11Z","title":"Prompt Injection attack against LLM-integrated Applications","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.05499","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Prompt injection attack against llm-integrated applications,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2306.05499","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:d0fdda46259c8a0ba0df0213e54925b6fe06a326a10e74751559613617a26021","observation_id":"d60a3ead-99eb-4f53-8a86-f018ab8c7572","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.14923","last_updated":"2024-10-22T00:53:48Z","snapshot_observed_at":"2026-08-16T13:07:52.644668Z","submitted_at":"2024-10-19T01:00:57Z","title":"Imprompter: Tricking LLM Agents into Improper Tool Use","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.14923","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Imprompter: Tricking llm agents into improper tool use,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2410.14923","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:5ab2b98b1c4135c0787a40e42e232ec4529df678e6b9959d881047f95ccfcf01","observation_id":"aa3314d3-c3fa-4027-98e2-0b3b8e754aea","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-11T23:45:02.178667Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"The instruction hierarchy: Training llms to prioritize privileged instructions,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:ff256309e5eb686ccc08637e5fa2405eb679f5228fd0db7ec897ae3b7375192d","observation_id":"ff8b731a-f784-41bb-8327-b93aea98fd3d","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"{StruQ}: Defending against prompt injection with structured queries,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:5d41adc8c7bb0cfc7f5ec5431f7cf9b35dd609efe79467ab983a1f4755af7b6d","observation_id":"9710b8c7-0f4b-4c32-b81c-2e2c3e4bf1d3","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Datasentinel: A game-theoretic detection of prompt injection attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:d90f5702206d431cdf39e44f02643249db0546ddb20dd291f635a6edda6523e5","observation_id":"f334b0a3-0707-4504-abdb-fe7d55d084ba","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2507.15219","last_updated":"2025-07-21T03:41:44Z","snapshot_observed_at":"2026-08-06T15:35:31.690602Z","submitted_at":"2025-07-21T03:41:44Z","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2507.15219","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Promptarmor: Simple yet effective prompt injection defenses,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2507.15219","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:30cc97e6f4d501984953ed3b71855538fbbb285445486f4ca242ce62766e7743","observation_id":"98bac509-7806-4ad5-b02d-770b779a9707","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.15547","last_updated":"2025-04-21T02:10:14Z","snapshot_observed_at":"2026-08-16T12:49:29.040180Z","submitted_at":"2025-03-17T05:27:57Z","title":"Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.15547","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Prompt flow integrity to prevent privilege escalation in llm agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2503.15547","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:07b1b40e148b8a3177ea1c431215d600c498722cf62a68f6829744c2b1968ae9","observation_id":"c00bd23e-3b1f-4081-9750-42e7b28dca22","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-13T15:19:02.871791Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Defeating prompt injections by design,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:95a880d64d2bf76ca85aee82b61ddd90c106ef1d03c3a5795146545d85918939","observation_id":"06284f71-e3be-4aa2-9643-7498b27d9bc9","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Claude code,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:3f434e1e92b27fe5b9b1f9790c66bcceb2f9126cbe32eb58bd82b1cc5b6899ef","observation_id":"79aa6edc-c976-400b-95cf-2ad149ccc101","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:accdbe6f5f6b2890d6828060247753bab871f01293c0c9d5a9b64d3a24ef381a","observation_id":"3f9f1c59-cfea-4e3a-baf4-6c49d1628fd8","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Google antigravity,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:586865b76087ce17e57d8a6be8a61633fc1f769221e7ea705842777b3b625363","observation_id":"5114a6ac-373b-4460-8ba8-a003bc0c0ba8","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Nanobrowser - open source ai web agent,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:5a8d872a44564c87ad58624f36ae933dbeacacfb0e29db5c5647133bf1cf798b","observation_id":"a662b706-24e1-4cbf-a36c-3a54aacdad25","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:127a3c44846d6fc26a4a4843825e10d808848369f2559bcf796e06f557f4e924","observation_id":"3e6da0e5-bd43-4186-8371-a632b58d4a29","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Toolformer: Language models can teach themselves to use tools,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:0b6d1e03a1f3e9d351008e2cfc993af090bdfb24e7672209105f4c5a6433aed5","observation_id":"d8755bb9-9c53-4372-9750-e82163526e73","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:6f28bfa004422b9b4aa0d55335a6c875ba3473726332fbb9923060307560cd8b","observation_id":"b8d8b969-6124-4a8c-b340-7c065e00981f","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.07283","last_updated":"2024-10-09T11:01:29Z","snapshot_observed_at":"2026-08-11T20:32:18.138792Z","submitted_at":"2024-10-09T11:01:29Z","title":"Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.07283","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Prompt infection: Llm-to-llm prompt injection within multi-agent systems,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2410.07283","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:17cf14a538022bb9810ad341f46ea8277186aa741c059a4a3d66ac51de67a1eb","observation_id":"4c0522da-0bf0-4a5e-91e8-2fc657b05cae","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Eia: Environmental injection attack on generalist web agents for privacy leakage,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:be384d27e6d4ff771f04f84a36e57d12be906f4cc2e9955380100edfbadbc3bc","observation_id":"3e7a3ec7-f6c3-4933-8cff-e1b0af2da59d","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Agentvigil: Generic black-box red-teaming for indirect prompt injection against llm agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:12b9ffc5f44c145b9aa030067f3c497188e2016458107610344491b99ad6d947","observation_id":"c500a932-bbf8-43ef-9566-fcbf7d81dba0","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Dissecting adversarial robustness of multimodal lm agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:952c35757bd9baab27ecde84c5fa11d1e6b704bdf8f684f714a03c4a0127e352","observation_id":"78859368-5870-4106-b258-08ffdc69049c","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Data execution prevention,","venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:44369e4eb460ad923697089b3395036f291ea7d2cba27c58f6978cc104c86e61","observation_id":"8fee6ffa-4277-4d24-943c-19a1240eda4e","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Formalizing and benchmarking prompt injection attacks and defenses,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:a69a09e5b50a5a3b7fd76b678fa4f408007126d22af767dfb1d19b59478a8602","observation_id":"9f837cff-9e22-448a-9604-2bcf81afed4c","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Delimiters won’t save you from prompt injection,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:f1ad0a34c5521afaba44de5a5129d16154882eb4f68407f990b30ec75d93ab66","observation_id":"2bddc5c5-00cb-4240-8c74-b0a1bac283e8","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2508.12175","last_updated":"2025-08-16T22:56:51Z","snapshot_observed_at":"2026-08-16T21:44:08.040098Z","submitted_at":"2025-08-16T22:56:51Z","title":"Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2508.12175","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Invitation is all you need! prompt- ware attacks against llm-powered assistants in production are practical and dangerous,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2508.12175","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:d1dec96f7c0d784c11e2ed8f96d2b04369eae2352003790beced3c0a8455ffd9","observation_id":"ef129ad2-b293-43bf-9f7c-a35baf8c6c3e","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Chatgpt atlas,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:262975add65aa56fcb1ef61cc681f1f127c8953244a529ad4e142e79881a203c","observation_id":"92a8f9da-1d35-44ad-b36a-a5ac21848e4d","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Pytorch: An imperative style, high-performance deep learning library,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:ec423f5a73212e504e6ddd8887c620089d0def4e8c2dbf8b8a58389c638bfed9","observation_id":"31ebb0e0-1170-4d19-a53a-04238dd915f7","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"{TensorFlow}: a system for {Large-Scale} machine learning,","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:ce88b04f18f839faae9e7b8d9088c4e947929adb561a4d711003c8fcb7ad2555","observation_id":"87286852-4156-48ac-803e-41264a591113","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Github cli,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:61ca58e0955bb62d318ad5d6deb81ef6122ffad1ff0dfc2b3d96b1096d3cb12c","observation_id":"2ce2515c-9779-466d-bebe-c2fa8720e388","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Github mcp server,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:bff8be730bfc1f903ce1bbe3198191409fa848840da84fc758ac3e7aee46204f","observation_id":"76d6bedb-24c4-41dc-b409-4e2bd9f4d459","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Keeping llms aligned after fine-tuning: The crucial role of prompt templates,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:6438ca97836184e368b95905293fd03a3942c18be4b650799c77eb23bba9601d","observation_id":"d60d25a4-17a4-4dc0-9138-abd2ae1e2de6","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.03574","last_updated":"2025-05-06T14:34:21Z","snapshot_observed_at":"2026-08-15T23:45:54.048231Z","submitted_at":"2025-05-06T14:34:21Z","title":"LlamaFirewall: An open source guardrail system for building secure AI agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.03574","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Llamafirewall: An open source guardrail system for building secure ai agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2505.03574","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:2510f9686ad273344111e9fc19a4bce78694c5bd1879b41932eda72c79764b59","observation_id":"f3188ae9-53d7-42bf-b598-c3578230d089","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-08-17T10:17:02.154661Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Design patterns for securing llm agents against prompt injections,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:c3bbd81ce488cbc01358b387a4d5bc65e6a60b71a28a292120a1e705eff6d938","observation_id":"9eb4f866-d0b6-498b-bfa0-d98b81f35732","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:8878b35ac06895a629f7b043f3e7a3abf2cd4ca26202c99caadaf1675ddce5a2","observation_id":"0528cdd3-554e-4a5d-a767-ace6916c8319","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.20984","last_updated":"2025-09-10T19:03:48Z","snapshot_observed_at":"2026-08-12T23:40:41.340437Z","submitted_at":"2025-04-29T17:55:52Z","title":"ACE: A Security Architecture for LLM-Integrated App Systems","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.20984","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Ace: A security architecture for llm-integrated app systems,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2504.20984","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:8cf6ffc4df9c1304e3e62342b1b51c4ebdd10016d005ecf31a0c6e78f6674b35","observation_id":"0735d94d-5e06-4a47-831e-1591fd8354c2","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.11703","last_updated":"2026-05-14T02:36:38Z","snapshot_observed_at":"2026-08-17T13:35:14.591010Z","submitted_at":"2025-04-16T01:58:40Z","title":"Progent: Securing AI Agents with Privilege Control","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.11703","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Progent: Programmable privilege control for llm agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2504.11703","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:57bb44f9472a1ddd6f12fc5661addb414bb9ec0af3e6069796d9a8aef3130b8d","observation_id":"5dd1713b-be86-47b1-9b78-f801b4b96b6d","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Contextual agent security: A policy for every purpose,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:303d731363146a7553d2462697beff6e5cf505adac5b4c0be6d06d33c0afb084","observation_id":"1a059039-8f7b-4ab3-b758-2b3dd2bcdabf","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Towards automating data access permissions in ai agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:22db54c080c1cf3c683d7b175b9cf51784ddbef9abcd66eae181ce8d57446079","observation_id":"f6c6e136-9b37-4948-82df-e6098eaf48e9","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"The dual llm pattern for building ai assistants that can resist prompt injection,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:5ca289feb59a52e2de9072de3900dd7698dfb6fce276e019b48c1fd1df6ce515","observation_id":"51b73398-6d18-4c87-8c88-ccc3cad9cf4e","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.19091","last_updated":"2024-10-10T15:29:07Z","snapshot_observed_at":"2026-08-16T18:58:20.908041Z","submitted_at":"2024-09-27T18:41:58Z","title":"System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.19091","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"System-level defense against indi- rect prompt injection attacks: An information flow control perspective,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2409.19091","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:ccd7a4da34da618972faeff9ff0ed0b28a9be75ead6f7a63a1922b9967cf7ae3","observation_id":"4e8ba3a0-d568-4feb-90df-954b596d3b68","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.23643","last_updated":"2025-09-03T12:30:47Z","snapshot_observed_at":"2026-07-06T21:33:02.686798Z","submitted_at":"2025-05-29T16:50:41Z","title":"Securing AI Agents with Information-Flow Control","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.23643","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Securing ai agents with information-flow control,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2505.23643","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:3e1e981b0eac63b48732b14c91ca405c97f4888f5f92e81eefad32cb8147e8a8","observation_id":"61fdd182-957a-42bf-a2e4-f3bd96768d0a","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Permissive information-flow analysis for large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:176302cbb5a65649004591987f95fa04b20bb288c41cb70fb3841507b8925f64","observation_id":"56c5da6e-2985-40fb-8e97-bf2b4794304f","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"How good are llms at processing tool outputs?","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:743454e057623af36c99526c1705c1d31c7e6e75c415d954f248565c47578cc1","observation_id":"35e2a5b8-66c6-43c9-92ad-54bb216f8e7f","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Llama prompt guard 2,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:3524c27e9cfdcdc2bd7d9e1138745ce5a64eac92986ea08d8330e9ee2d45e05b","observation_id":"ed286d7a-9d26-4d38-b8a8-6d92d56097fb","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"React: Synergizing reasoning and acting in language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:de941e4c5d2b98d624e67715180a88de883de48de1fea5348692ff2adffdaf62","observation_id":"d3b265e4-301c-4cfb-9d66-2d77b8258018","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Great, now write an article about that: The crescendo {Multi-Turn}{LLM} jailbreak attack,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:dd2ccd5417a7bbb072efe0f5edd7a606672aea4597cc756913fe84e6fe273c6a","observation_id":"a486fd7e-83da-4857-ac0c-66e3dfecfcc9","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Universal adversarial triggers for attacking and analyzing NLP,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:7e41d4f329db4259d1754479fa4bf057711e5a11d9de67cc8c783e119ca776c8","observation_id":"de4602ce-ebe3-40e8-91ec-10029032a4dd","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:4e5717a82de7915a904c013bff935cdc934b17a35f73d919faf2e2e667b525bc","observation_id":"74448141-3b7a-41fc-ad64-a5e8e28087c0","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Open sesame! universal black- box jailbreaking of large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:5547e4e2aa2274bc99ae3828dde5e955aa7724b44aba640bbe36c0b28bf76007","observation_id":"06a654c9-40ef-48c7-8130-60f5110a5ffc","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.04295","last_updated":"2024-08-30T11:57:47Z","snapshot_observed_at":"2026-08-12T17:45:10.384900Z","submitted_at":"2024-07-05T06:57:30Z","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.04295","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Jailbreak attacks and defenses against large language models: A survey,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2407.04295","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:25558a9b897c5c26c4c0f0b748683b13da654e465e85834f3ea7f72ec7eb85fa","observation_id":"f4f301ce-b07e-4ab4-8cb8-6de2ca6b356d","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Pleak: Prompt leaking attacks against large language model applications,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:2f8cf0d613dfd4ae50c40b15faa3f1a27375470daea207f77455d067f6d8836f","observation_id":"41b0f911-0f95-4b49-9d8c-f76431c2a69b","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2211.09527","last_updated":"2022-11-17T13:43:20Z","snapshot_observed_at":"2026-08-15T06:26:47.552378Z","submitted_at":"2022-11-17T13:43:20Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2211.09527","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Ignore previous prompt: Attack techniques for language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2211.09527","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:8f49db63923afae8e0e35a256a4287c53ce6cc7344109443fcc3779559ade6db","observation_id":"0833b53e-7bac-4fb6-bbf1-bf3d0321e259","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.06865","last_updated":"2024-08-07T22:05:01Z","snapshot_observed_at":"2026-08-16T15:16:27.668854Z","submitted_at":"2023-07-13T16:15:08Z","title":"Effective Prompt Extraction from Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.06865","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Effective prompt extraction from language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2307.06865","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:5178c57036dab5f20a1e918b8a7cde7f4cd40850759cb0a2ac19e7c5f104e2f7","observation_id":"e8475828-cbb4-4a10-93df-e90e0ecbd824","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Les dissonances: Cross-tool harvesting and polluting in multi-tool empowered llm agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:c3cb764fb1f86843abc46459927a2799ccd01741a2d188f43e04b5301a6d2e87","observation_id":"51add82a-8060-4348-bbd4-2cf44c449ae3","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Task injection – exploiting agency of autonomous ai agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:799da2ae162e8e2458f72345ca1343a8e2347461fe5cdec20cef27456ae8ef8b","observation_id":"cc151831-632a-4836-9ca5-43723a7c1b6e","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Optimization-based prompt injection attack to llm-as-a-judge,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:14ec63eeabfec81642c68b772b938ced9e47af45953d30b0bddc157fb4dac7c8","observation_id":"4aa1d9cf-8616-4beb-9bf5-cd2622676114","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:54213c0eb6ac1c43f184c6e55b3520a1be512eb6145caffe4b38f9d05ddb4372","observation_id":"8b0dca96-adff-4126-acdb-c100e9781103","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02691","last_updated":"2024-08-04T04:52:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-05T06:21:45Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.02691","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2403.02691","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:7d55e28d0917738441764655a733e7c1b3f6b3e76132d29acb4e405be2dec1d3","observation_id":"df324fb1-a787-4af5-b498-94d104213b04","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Benchmarking and defending against indirect prompt injection attacks on large language models,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:33014a2f76e817aafbcc7f2267ae08a9df352affdd5b9e62221aad24a3b8d005","observation_id":"6709bc17-544d-4bfc-aab3-6a02e291add6","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"WASP: Benchmarking web agent security against prompt injection attacks,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:6ded162e89887f1ef174cb65583376eac0f1e366c3debdc8c071cbb0eb08c0db","observation_id":"b14e7e5c-79ac-4608-8271-2138dfdce6fd","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.28999","last_updated":"2026-05-27T18:56:19Z","snapshot_observed_at":"2026-07-06T23:38:27.990823Z","submitted_at":"2026-05-27T18:56:19Z","title":"Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.28999","snapshot_observed_at":"2026-07-11T08:31:36.099368Z","title":"Measuring real-world prompt injection attacks in llm-based resume screening,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-07-11T08:31:36.099368Z"},"links":{"cited_paper":"/paper/2605.28999","citing_paper":"/paper/2607.05120"},"observation_digest":"sha256:099d3396e2cb8824b3c3470d2d1820ad49a23d31ad84bbd8a7e463cd5055519b","observation_id":"b258b0a1-5a87-4228-ab68-c25d4736f567","resolution":{"observed_at":"2026-07-11T08:31:36.099368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.05120","last_updated":"2026-07-06T14:07:49Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-05T18:00:12.068331Z","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents"},"reference_resolution":{"displayed":65,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":65,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":65},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"thesis":"As of 17 August 2026, this Paper Citation Record lists 65 of 65 outbound references and 1 inbound Pith citation observation for arXiv:2607.05120."}