{"as_of":"2026-08-21T01:35:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:11c00a597ba59cfbd29ab5b2bf0d3d9095051f9d54e8379ec1daf94133b11cad","coverage":[{"denominator":106,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":100,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-10T12:20:03.672480Z","state":"measured"},{"denominator":100,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":100,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-20T06:33:59.587034+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.08147/citation-record","integrity":"/paper/2607.08147/integrity","json":"/paper/2607.08147/citation-record.json","paper":"/paper/2607.08147"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.460655Z","title":null,"venue":null,"work_id":"8d8aedd4-9653-49f2-bac7-561ad67fdc1a","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:1edfcccf0e1fcd711ceff9c27d086c315279bff1c016737a38b636e35a3e5a83","observation_id":"9ed1892d-39d2-4ea4-ad76-3765c435f643","resolution":{"observed_at":"2026-07-10T12:27:04.461705Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.423626Z","title":"2024.Developing a computer use model","venue":null,"work_id":"b32e001f-0b52-4a07-8f02-47a1dc3da2e1","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:8b458727ebe7f20c4cd21519edb8f226a9d74f69f5813f9bd729e9e6fb7bf368","observation_id":"4bbf902e-ede2-472a-86ea-c25213a10203","resolution":{"observed_at":"2026-07-10T12:27:04.424634Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.457618Z","title":null,"venue":null,"work_id":"fb564d8a-79a3-4e31-961e-af15edd09851","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:a61aa6adab44b1f2c00baec77bbde607f106447ba2f83c2fa443bc3757777ad0","observation_id":"92b31706-380e-4579-a44a-4535e34d21d5","resolution":{"observed_at":"2026-07-10T12:27:04.458643Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.411012Z","title":null,"venue":null,"work_id":"86730c63-abba-4160-8fd8-04425e08856c","year":2008},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:4845041064b25f4e60c579cb14688cbfcf23b1e3d675fd2e94f30a3426aadc32","observation_id":"3842d1b1-8c53-4580-85f6-2212d4c876c6","resolution":{"observed_at":"2026-07-10T12:27:04.412192Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.456180Z","title":null,"venue":null,"work_id":"d531dd71-bbf3-4d98-8fc8-062b017a0997","year":2016},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:d36e64cc4fbcd1d629798c2b4d5faf84915a4294ed17bf6a97674d7cc9bdc5e2","observation_id":"a36b4759-687b-4218-b34c-8c7b3ba7ef37","resolution":{"observed_at":"2026-07-10T12:27:04.457155Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.407698Z","title":null,"venue":null,"work_id":"7ab3a588-881f-4e1b-a60d-f0e103a4b6f8","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:e4478cf49d3ba763c748e9ff289657c5dbfd7761602f6300e2db70dcad910017","observation_id":"8b8b7c08-e707-4e6d-be6f-35f2f1b72de3","resolution":{"observed_at":"2026-07-10T12:27:04.408862Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-08-20T20:50:11.979865Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"cited_work":{"arxiv_id":"2506.08837","doi":"10.48550/arxiv.2506.08837","metadata_source":"pith","pith_arxiv_id":"2506.08837","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"(IBM, Invariant Labs, ETH Zurich, Google, Microsoft)","venue":"cs.LG","work_id":"70848d7e-8598-47ff-8b1a-58f3b3bd25a0","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2506.08837","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:26fe1c29e9f86cf102bedb065aa48c6785c25b6c03a61802edf80ae278ecc5c3","observation_id":"bfd5d8d7-340e-4927-ae45-9a02af7cf509","resolution":{"observed_at":"2026-07-10T12:27:04.099528Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.454660Z","title":null,"venue":null,"work_id":"46e4aadc-c6f6-4bb5-bcde-cb3d90fc4cf0","year":1977},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:cfe53d34ff5ce1115db289e348f5ce4038f1d05ca2b0ebf17aac215c3e3df690","observation_id":"5e9c24f0-64b6-4dac-9c4b-6bee8bdb43f5","resolution":{"observed_at":"2026-07-10T12:27:04.455691Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.453118Z","title":null,"venue":null,"work_id":"c8877520-027e-428c-bb52-db6f076a426a","year":2026},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:ff85b368fdba6d190cc33a06781d536ed8c4bc008133b4729c39837fcb30de32","observation_id":"99efca18-b351-4e11-9a95-253f05c0b8ea","resolution":{"observed_at":"2026-07-10T12:27:04.454093Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.06363","last_updated":"2024-09-25T19:48:39Z","snapshot_observed_at":"2026-08-19T16:46:32.130363Z","submitted_at":"2024-02-09T12:15:51Z","title":"StruQ: Defending Against Prompt Injection with Structured Queries","version":2},"cited_work":{"arxiv_id":"2402.06363","doi":"10.48550/arxiv.2402.06363","metadata_source":"pith","pith_arxiv_id":"2402.06363","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Struq: Defending against prompt injection with structured queries","venue":"cs.CR","work_id":"5e57b942-26b0-4859-8393-c0fa2c2ad65b","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2402.06363","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:567c2496b6a201a0bed81a9629a1b8958e000531fc9b95d0680edd7a806f30dd","observation_id":"207b19ef-cb81-4389-bde3-75545df790e4","resolution":{"observed_at":"2026-07-10T12:27:04.058393Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.12284","last_updated":"2026-04-14T04:50:35Z","snapshot_observed_at":"2026-08-15T23:42:02.333196Z","submitted_at":"2026-04-14T04:50:35Z","title":"WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agents","version":1},"cited_work":{"arxiv_id":"2604.12284","doi":"10.48550/arxiv.2604.12284","metadata_source":"pith","pith_arxiv_id":"2604.12284","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agents","venue":"cs.CR","work_id":"b1e04804-d639-49b4-9470-e09c967105ae","year":2026},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2604.12284","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:0d283a417775f91dd54d03b049602702637d66595b7a767267922ef4832338b8","observation_id":"a1942c66-4eca-43c5-bafc-0ca199290442","resolution":{"observed_at":"2026-07-10T12:27:04.055591Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.451552Z","title":null,"venue":null,"work_id":"ab0d6791-3a43-4fdd-9bbb-12f397aec5b2","year":null},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:3a19d7112e6eb948ad15ab3b32870023ab80b4ce8c161802755258cca1d5d9b5","observation_id":"151b74eb-56d5-4b21-92e5-22db732711eb","resolution":{"observed_at":"2026-07-10T12:27:04.452625Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2507.05630","doi":"10.48550/arxiv.2507.05630","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"How not to detect prompt injections with an llm","venue":"ArXiv.org","work_id":"f30a37ea-b8c5-4de7-a6c1-58f1d122f3e2","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:bc3ed6c0428357062275daf64ae004d27d258a5109af673d92ab7cc51d9d942e","observation_id":"cb7212e2-1c6c-4d47-adc1-190ef77d029d","resolution":{"observed_at":"2026-07-10T12:27:04.161716Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.450074Z","title":null,"venue":null,"work_id":"e3e8105d-0ad8-4129-a959-49533cc01710","year":2026},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:6631309a3b9abe184e649b1fc33f61e6b333fa312ae833ac37ae18bea1989a21","observation_id":"89914b78-06bf-40c5-8a52-327441f0fbe9","resolution":{"observed_at":"2026-07-10T12:27:04.451081Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.446989Z","title":null,"venue":null,"work_id":"518a640e-c470-43a7-93b9-813667c84cc2","year":null},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:a91fbd88e7ff6911c6c774e7656f17c416c33f183d7ffce8a4e48ac3dbcd7327","observation_id":"7408b8a4-a073-4472-80b1-eb5883f95fda","resolution":{"observed_at":"2026-07-10T12:27:04.447944Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.23643","last_updated":"2025-09-03T12:30:47Z","snapshot_observed_at":"2026-07-06T21:33:02.686798Z","submitted_at":"2025-05-29T16:50:41Z","title":"Securing AI Agents with Information-Flow Control","version":2},"cited_work":{"arxiv_id":"2505.23643","doi":"10.48550/arxiv.2505.23643","metadata_source":"pith","pith_arxiv_id":"2505.23643","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Securing AI Agents with Information-Flow Control","venue":"cs.CR","work_id":"58ee5225-7de4-4e38-b970-5afd29ddd925","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2505.23643","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:7ce4649cae6aac907e5c09d1ffdcbd1c8dfb9a3484158210738dacfe9645222b","observation_id":"bfc1bfe1-7559-4a8a-a14f-47131b9b8ece","resolution":{"observed_at":"2026-07-10T12:27:04.148644Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-20T10:01:00.326084Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:2009c9af5a3e61534009bbc141d1e92a8bce55efd996850c67ca534d9876febe","observation_id":"ccfd81c9-52d2-4ac0-9354-4e2fa0f23205","resolution":{"observed_at":"2026-07-10T12:27:04.209196Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.445485Z","title":null,"venue":null,"work_id":"26c2def9-cabb-4248-888a-83ff37a95dea","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:2e7ef64ec11c1e790c2a40c41282f016e5f1dc4985f8374756832f9f05579f48","observation_id":"ef897733-b2f0-41ce-b9d6-449eb170e45f","resolution":{"observed_at":"2026-07-10T12:27:04.446491Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.06070","last_updated":"2023-12-09T05:57:46Z","snapshot_observed_at":"2026-08-14T08:19:18.935225Z","submitted_at":"2023-06-09T17:44:31Z","title":"Mind2Web: Towards a Generalist Agent for the Web","version":3},"cited_work":{"arxiv_id":"2306.06070","doi":"10.48550/arxiv.2306.06070","metadata_source":"pith","pith_arxiv_id":"2306.06070","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Mind2Web: Towards a Generalist Agent for the Web","venue":"cs.CL","work_id":"e26f5a00-c007-439d-83f6-7900f5687b6b","year":2023},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2306.06070","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:4fbbaa035a63ba2f59aec2c4853c8eb8be12540f94b522ba7f55fd93f510633f","observation_id":"0bb260aa-9fd6-4607-ac1d-c59548ad975d","resolution":{"observed_at":"2026-07-10T12:27:04.117145Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-15T07:08:14.081022+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-15T07:08:14.081022+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.443899Z","title":"Laradji, Manuel Del Verme, Tom Marty, David Vazquez, Nicolas Chapados, and Alexandre Lacoste","venue":null,"work_id":"6cef9418-0ab6-4a4e-869c-2cc3910ec182","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:b145c05d759924520603a6fb576dafe8c47d3682633446bb0ebf07431bc136ab","observation_id":"0c0702df-0000-48b6-a172-b8e96a90b381","resolution":{"observed_at":"2026-07-10T12:27:04.445006Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.18575","last_updated":"2025-05-16T22:42:29Z","snapshot_observed_at":"2026-08-15T08:43:14.412859Z","submitted_at":"2025-04-22T17:51:03Z","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","version":3},"cited_work":{"arxiv_id":"2504.18575","doi":"10.48550/arxiv.2504.18575","metadata_source":"pith","pith_arxiv_id":"2504.18575","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","venue":"cs.CR","work_id":"bf1914b2-fd32-4768-a4d5-84720606d71b","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2504.18575","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:badba98ef2f587d69c9c73a9f093901b5fc90f0503a90f790acc2482582d8c3a","observation_id":"959e9625-3a02-4e1f-aadd-af2e8403dbaf","resolution":{"observed_at":"2026-07-10T12:27:04.228939Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2601.09923","last_updated":"2026-06-04T15:38:02Z","snapshot_observed_at":"2026-08-19T21:09:59.831114Z","submitted_at":"2026-01-14T23:06:35Z","title":"CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents","version":3},"cited_work":{"arxiv_id":"2601.09923","doi":"10.48550/arxiv.2601.09923","metadata_source":"pith","pith_arxiv_id":"2601.09923","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Camels can use computers too: System-level security for computer use agents","venue":"cs.AI","work_id":"44b54730-e6b2-4e8c-b6af-7c422996c093","year":2026},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2601.09923","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:969146204d1c1ef54b0b0570824a9332a6141ae14650f5f546e82a63e82d454b","observation_id":"feca462b-7ad3-437f-8232-bfc0be91fb3e","resolution":{"observed_at":"2026-07-10T12:27:04.156803Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.18653/v1/2025.acl-long.146","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":null,"venue":null,"work_id":"58584fe4-e53f-4d46-af0b-68ce6f3f1d79","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:6de826ff035daf895e9f39276decf683c286c09473fd04f6b0a587532a0958d0","observation_id":"645a0073-6baf-4156-a77e-90fd89d8fc14","resolution":{"observed_at":"2026-07-10T12:27:04.163418Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1609/aaai.v39i22.34568","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts , booktitle =","venue":"Proceedings of the AAAI Conference on Artificial Intelligence","work_id":"d265a66f-0cfd-4c01-9f5f-1c6d6ac2c5bf","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:c83e911c9d665d6e5ce22e1602f2b9ed7822b38406e8a4e80f4a8a8dbdef6ba9","observation_id":"430b0bf1-c1e4-49a4-a930-c90914908f98","resolution":{"observed_at":"2026-07-10T12:27:04.108615Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-06T20:38:17.219424+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-06T20:38:17.219424+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"answer/6023110","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.245337Z","title":null,"venue":null,"work_id":"d5e839b9-9305-4f50-9c36-cd88bc3c437d","year":2022},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:fd45b08b2e2075bbbc52004ac942a2a2758f0ad5668e57f8e23c3c59882f204d","observation_id":"13c0f375-bf0f-436d-a492-a35d7f2350d7","resolution":{"observed_at":"2026-07-10T12:27:04.246549Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.442071Z","title":null,"venue":null,"work_id":"c5e46f50-0933-4e8c-8ddd-47b0d91f7f89","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:7093e3721626066cf1012edb241aef2854083df740e37eae4ec05c0b32e8721a","observation_id":"91638d94-6088-4f4f-970a-5ab824b3f64c","resolution":{"observed_at":"2026-07-10T12:27:04.443247Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.440346Z","title":null,"venue":null,"work_id":"a18fc31e-9550-4714-a913-6c5fc9902144","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:343427e0236dc934826e5094d3ddad804b44a124972b1704a7a5f8be8e358459","observation_id":"2f1be916-6107-4a88-9bbc-4bed212cab73","resolution":{"observed_at":"2026-07-10T12:27:04.441356Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.438671Z","title":null,"venue":null,"work_id":"c88c3aec-cf93-4ef2-a2ad-82f13504789c","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:92d6280e450fd2f2bbd5fb6589849bc6f02032f240654d3ff546aef8538773d7","observation_id":"06f3fbdd-6444-4892-8c70-bc32bac3d968","resolution":{"observed_at":"2026-07-10T12:27:04.439781Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.436499Z","title":"2024.Buying Spying: Insights into Commercial Surveillance Vendors","venue":null,"work_id":"3bc6cc88-b7c6-4fa0-858e-7dc70030c1c0","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:3ceb4d54ec735c9b5f9de649353e074ec46d28e655e930ed51841cd87645c2f3","observation_id":"63d4aa18-e918-4c2b-bc5e-241e1a3c0bbc","resolution":{"observed_at":"2026-07-10T12:27:04.437728Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"5764.362398","doi":"10.1145/3605764.3623985","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"InProceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec @ CCS 2023)","venue":null,"work_id":"0b235739-d106-431c-aed9-3675d531c886","year":2023},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:ebbd89921bad5adcb5f4b4daf768cda54717641cf159f677360866bb6844ff3e","observation_id":"b5cdfa6e-58b3-4daf-bfff-6ad7bc32e81f","resolution":{"observed_at":"2026-07-10T12:27:04.088533Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-07-12T05:19:17.163767+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-12T05:19:17.163767+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.434894Z","title":"2007.XSS Attacks: Cross-Site Scripting Exploits and Defense","venue":null,"work_id":"babb4d01-160d-49a9-9681-5a2e7aa07a11","year":2007},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:f3da41e3b18a528d32d7c0af4c5a47c2ef3a7e80b731922889817fded5fb5816","observation_id":"2fc42c52-b94d-4f3e-85ba-2c8742f0d43a","resolution":{"observed_at":"2026-07-10T12:27:04.436046Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"5456.346758","doi":"10.1145/3465456.3467589","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":null,"venue":null,"work_id":"4a75ee5a-72d4-4d5e-a4da-7ec7296cb529","year":2021},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:3db602e5580ce5b07d1cb59054a9a0d414a00580859c8ac6abe0d906be92ab5f","observation_id":"61b8c471-2866-4a18-b028-6d0983ecbedc","resolution":{"observed_at":"2026-07-10T12:27:04.111679Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.433349Z","title":null,"venue":null,"work_id":"a4355276-8c14-4e50-97e6-04b7c6ed691a","year":2011},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:d4c945da00538307b34cc0bb422f6fa8dc9a67997dcf7d833bfe0a1f94cc71cc","observation_id":"732c8734-c522-42e8-81c8-8e2133a7244c","resolution":{"observed_at":"2026-07-10T12:27:04.434339Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2509.07764","last_updated":"2025-09-09T13:59:00Z","snapshot_observed_at":"2026-08-16T08:20:46.909525Z","submitted_at":"2025-09-09T13:59:00Z","title":"AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents","version":1},"cited_work":{"arxiv_id":"2509.07764","doi":null,"metadata_source":"pith","pith_arxiv_id":"2509.07764","snapshot_observed_at":"2026-07-10T12:27:04.202487Z","title":"AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents","venue":"cs.CR","work_id":"5b771a0b-2423-4547-ac17-39e2741b07aa","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2509.07764","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:b3f50d64baa40db5a9608631eebae99ab82ded468cdc0b2733471b9fa3103c53","observation_id":"680a7689-331d-4284-9dfc-bf4d93a7b01e","resolution":{"observed_at":"2026-07-10T12:27:04.203837Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.431614Z","title":null,"venue":null,"work_id":"4a8777c7-4f7b-4078-ac1c-ec4f50d8df70","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:0d7554d64a71d4f5e14d61aeb8e4393bf0d7faf554cf2265de0c0a6a18127ebf","observation_id":"bd275a84-b3a0-44d0-bf6a-7fbc054cf662","resolution":{"observed_at":"2026-07-10T12:27:04.432844Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.448418Z","title":"2014.SafeFrames v1.1 Specification","venue":null,"work_id":"05a9d06a-cd49-4b7b-8e14-e2c57de79b5b","year":2014},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:1c66c9f418f69ca091e9b556e55e0cfb4dd100adb0ca9d6123b3732243c75336","observation_id":"05ca91fa-5da8-4657-af49-32317ee5d4a0","resolution":{"observed_at":"2026-07-10T12:27:04.449575Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18333","last_updated":"2025-05-23T19:39:56Z","snapshot_observed_at":"2026-08-07T14:30:46.734293Z","submitted_at":"2025-05-23T19:39:56Z","title":"A Critical Evaluation of Defenses against Prompt Injection Attacks","version":1},"cited_work":{"arxiv_id":"2505.18333","doi":"10.48550/arxiv.2505.18333","metadata_source":"pith","pith_arxiv_id":"2505.18333","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"A critical evaluation of defenses against prompt injection attacks","venue":"cs.CR","work_id":"5fb5747c-65a0-4edd-9214-08cb922b6d8e","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2505.18333","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:72ddc2ebdfc06c1ea40e4fb4b93d794d738ba11854c3f7ebac51a0502a1583e2","observation_id":"29b0161e-57a1-4447-b999-729208bedcbd","resolution":{"observed_at":"2026-07-10T12:27:04.065942Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2511.05797","doi":"10.48550/arxiv.2511.05797","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"When ai meets the web: Prompt injection risks in third-party ai chatbot plugins","venue":"arXiv (Cornell University)","work_id":"45bc4278-a1cd-463d-b471-cd555cee6c10","year":2026},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:4c4bcd8bd833625e69d0f65c49ed34631f1c6a4583f43d720d726908fed1c05b","observation_id":"90bb07a5-8afa-45e1-884c-6b85788bbca7","resolution":{"observed_at":"2026-07-10T12:27:04.154222Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.430069Z","title":null,"venue":null,"work_id":"50fd4203-6c58-4e9b-9ec5-249d028e98e1","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:61ac90d61cbcfadfd7ea8d57f9041453be4fea70c28c5eb27a8752721e483d77","observation_id":"833f5c4d-1bd5-4524-b943-85d8532a93d1","resolution":{"observed_at":"2026-07-10T12:27:04.431074Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2401.13649","last_updated":"2024-06-06T02:01:09Z","snapshot_observed_at":"2026-08-15T00:56:43.641640Z","submitted_at":"2024-01-24T18:35:21Z","title":"VisualWebArena: Evaluating Multimodal Agents on Realistic Visual Web Tasks","version":2},"cited_work":{"arxiv_id":"2401.13649","doi":"10.48550/arxiv.2401.13649","metadata_source":"pith","pith_arxiv_id":"2401.13649","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"VisualWebArena: Evaluating Multimodal Agents on Realistic Visual Web Tasks","venue":"cs.LG","work_id":"37f08c56-1b7d-4d9e-baf9-7c2ebb7e6acd","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2401.13649","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:a29525a0d8e50c1c6a8d37fa5912b1974a180beea6fecf1f7a8bc69147a514d8","observation_id":"2a71e710-8ad6-41b6-9c23-e08f9cd1fd82","resolution":{"observed_at":"2026-07-10T12:27:04.071223Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-15T07:08:14.13759+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-15T07:08:14.13759+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2375.362389","doi":"10.1145/362375.362389","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Communications of the ACM , volume =","venue":"Communications of the ACM","work_id":"9212343e-1ec5-4f07-b94c-b91a46e10eb3","year":1973},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:6f8fc0b75f95e88b49bc45cf2b0f7a1e83132659a1ab812c0532d5e40c93c0ae","observation_id":"1f405e3c-67a4-4724-8bd9-de026c7e52cd","resolution":{"observed_at":"2026-07-10T12:27:04.151227Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.23791","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.240256Z","title":"The cognitive firewall: Securing browser based ai agents against indirect prompt injection via hybrid edge cloud defense","venue":null,"work_id":"52701299-e193-43b7-94a4-727054425cce","year":2026},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:dd371159d6f301529c304bb97917dce8bc02f01401e8ec506ebbaa6463c4b7be","observation_id":"2390903c-db00-4ea5-89de-59768591be00","resolution":{"observed_at":"2026-07-10T12:27:04.241695Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2019.23386","doi":"10.14722/ndss.2019.23386","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation","venue":null,"work_id":"9b3a99ef-2006-40fd-957f-02c6db1902e3","year":2019},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:6c1e3e6476a3b856910dd86fe9c6c2e4418e68f0ed00c8e334788463c7224476","observation_id":"c77b9ee5-464a-4e11-b2d5-86cec6f6ce57","resolution":{"observed_at":"2026-07-10T12:27:04.076461Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-05-22T22:23:03.472208+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-22T22:23:03.472208+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.428472Z","title":null,"venue":null,"work_id":"dfa77da1-ec37-4fc8-80c1-1461656a6390","year":null},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:7ef48e7f60d53e7ca2203badb3ed834c87a5b13eb4903d0af3b0ab471cba1b41","observation_id":"2d606753-37e1-48b1-b1fe-9f38415b8e9a","resolution":{"observed_at":"2026-07-10T12:27:04.429593Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.459137Z","title":"In25th USENIX Security Symposium","venue":null,"work_id":"efed1c4f-60e4-4cb5-9142-d9d49bacebf7","year":1996},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:445ebd3504f3b172efb7699031c9481339e9e7ab2dc6b60b2bb90930e0a2fa68","observation_id":"9b8e1877-6ef2-483e-a8fb-b7d0c296f5dc","resolution":{"observed_at":"2026-07-10T12:27:04.460148Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1007/978-3-031-73464-9_11","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":null,"venue":"Lecture notes in computer science","work_id":"f9aae046-37ac-49e3-acfd-43203f9d3ee8","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:bd2b27d82f796df2180ad02e53d02fe01f95d2ae36411bb13a84ead869291a6d","observation_id":"54082bad-c27e-4015-95d7-64cc6507fe2f","resolution":{"observed_at":"2026-07-10T12:27:04.063278Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2409.11295","last_updated":"2025-03-12T20:54:00Z","snapshot_observed_at":"2026-08-19T20:31:13.864118Z","submitted_at":"2024-09-17T15:49:44Z","title":"EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage","version":5},"cited_work":{"arxiv_id":"2409.11295","doi":"10.48550/arxiv.2409.11295","metadata_source":"pith","pith_arxiv_id":"2409.11295","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Eia: Environmental injection attack on generalist web agents for privacy leakage","venue":"cs.CR","work_id":"648feaca-04ca-4033-83b0-94571d951968","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2409.11295","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:e76c480a831ef94e152428e4017e762d18718bbda51643ec0bfc3565361b7788","observation_id":"09232739-3b47-4587-adea-ada3ad50082f","resolution":{"observed_at":"2026-07-10T12:27:04.061309Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05499","last_updated":"2025-12-29T02:25:27Z","snapshot_observed_at":"2026-07-06T15:40:27.639368Z","submitted_at":"2023-06-08T18:43:11Z","title":"Prompt Injection attack against LLM-integrated Applications","version":3},"cited_work":{"arxiv_id":"2306.05499","doi":"10.48550/arxiv.2306.05499","metadata_source":"pith","pith_arxiv_id":"2306.05499","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Prompt Injection attack against LLM-integrated Applications","venue":"cs.CR","work_id":"977b4683-bba6-49d6-8f3d-496c41cb7fac","year":2023},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2306.05499","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:afcb91e76626332efcb212fe7cce6e00d5d3fa56bf2c99158b5b7391c984a88c","observation_id":"c27d4fe3-3efb-44b6-9110-e463d8b64179","resolution":{"observed_at":"2026-07-10T12:27:04.236378Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.426878Z","title":null,"venue":null,"work_id":"cee63581-3f07-407f-b967-375891b8522d","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:86a765ca6e188b7bc7581ae3c30f41d427c909adbb1935dbf4220280bae50bf0","observation_id":"a7deb793-7bca-4f46-ac89-962beb6c5db5","resolution":{"observed_at":"2026-07-10T12:27:04.427949Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"1157.2025","doi":"10.1109/sp61157.2025","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"In: IEEE Symposium on Security and Privacy (S&P)","venue":null,"work_id":"a0c5de2d-efac-48fc-b13a-974e47947668","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:ed758869745f8a33922747446a18e9d134d987ead06de64eec8d4594c9b53d26","observation_id":"d27de9fc-ce34-490d-8364-84501722e9c7","resolution":{"observed_at":"2026-07-10T12:27:04.159194Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-07-13T11:50:05.157437+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-13T11:50:05.157437+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.425134Z","title":null,"venue":null,"work_id":"441b82f8-5bac-4336-9813-01dcc01b71d8","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:6ed4634714a308e2b65ec3678645fa6a08522687341fcba8192c1413ed7513f2","observation_id":"21a81851-ca04-49ef-b2d3-172fc0dc118b","resolution":{"observed_at":"2026-07-10T12:27:04.426370Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.02544","last_updated":"2025-09-05T09:21:10Z","snapshot_observed_at":"2026-08-16T13:28:26.846597Z","submitted_at":"2024-08-05T15:16:22Z","title":"Caution for the Environment: Multimodal LLM Agents are Susceptible to Environmental Distractions","version":3},"cited_work":{"arxiv_id":"2408.02544","doi":"10.48550/arxiv.2408.02544","metadata_source":"pith","pith_arxiv_id":"2408.02544","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Caution for the environment: Multimodal agents are susceptible to environmental distractions","venue":"cs.CL","work_id":"3d080ecd-5d1f-4c8c-b59f-e5b20602805f","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2408.02544","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:26dd005b0f4d41f3a39335913e75092367b61735f2a0fd7a43a7524b2b1969d2","observation_id":"92656bb2-3fb7-4004-9f97-7bfa0401a037","resolution":{"observed_at":"2026-07-10T12:27:04.129222Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.396986Z","title":null,"venue":null,"work_id":"afb45b43-6375-42f2-aef3-239fcaee04ca","year":2022},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:f90c523f07b30bf28ff32fd12a4fa4503df83668edadc2c34826733e6e7f63ba","observation_id":"7904fe81-fece-46ee-8132-b25f5b83fce0","resolution":{"observed_at":"2026-07-10T12:27:04.398114Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.01861","last_updated":"2025-07-09T13:52:32Z","snapshot_observed_at":"2026-08-20T09:15:33.338973Z","submitted_at":"2025-02-24T09:31:56Z","title":"Towards Enterprise-Ready Computer Using Generalist Agent","version":3},"cited_work":{"arxiv_id":"2503.01861","doi":"10.48550/arxiv.2503.01861","metadata_source":"pith","pith_arxiv_id":"2503.01861","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Towards Enterprise-Ready computer using generalist agent","venue":"cs.DC","work_id":"6ef6a24f-1fc9-48e0-8354-955665270fb4","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2503.01861","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:94c836b2123504b827bf7ceb4207c95dc3140910d9d0f6fdc98098da69ef694b","observation_id":"5e902364-51d7-46a1-a3d6-204eb5b15ee4","resolution":{"observed_at":"2026-07-10T12:27:04.082589Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.422091Z","title":null,"venue":null,"work_id":"a4b8bbb4-42e3-4644-9da7-97c88c1d347e","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:6392b170e469a946ba6ad0e4606d92a605f22032997e5c664410dec616f67a1c","observation_id":"00e84308-fbbf-454c-b33e-a0fef468a261","resolution":{"observed_at":"2026-07-10T12:27:04.423125Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.420491Z","title":null,"venue":null,"work_id":"ef443cee-0d72-49b6-adfd-06227c83b6f1","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:b33a3dfb90e8f483fb48ab79537a1229194dbc74809e957ac7c881d605b5245c","observation_id":"dc5bd7ee-c62d-47e4-96d7-0a2a50f5f758","resolution":{"observed_at":"2026-07-10T12:27:04.421599Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2512.12594","doi":"10.48550/arxiv.2512.12594","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"cellmate: Sandboxing browser ai agents","venue":"arXiv (Cornell University)","work_id":"3994ee1f-f65b-4f8b-93e9-6ec20a5e0988","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:cc9d8872bf947e653ad257a1e1279bfca65f528351ec070bd15a371d65081868","observation_id":"ef81614d-e34c-4405-890d-2f7fd7205994","resolution":{"observed_at":"2026-07-10T12:27:04.124731Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.09023","last_updated":"2025-10-10T05:51:04Z","snapshot_observed_at":"2026-08-15T07:47:42.680001Z","submitted_at":"2025-10-10T05:51:04Z","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","version":1},"cited_work":{"arxiv_id":"2510.09023","doi":"10.48550/arxiv.2510.09023","metadata_source":"pith","pith_arxiv_id":"2510.09023","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","venue":"cs.LG","work_id":"585d66b7-a25c-4390-a7c8-8b15064c122f","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2510.09023","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:de33787a7cf3f05e34e598e591f392603a52aa51e8bbe247250344ac990f69af","observation_id":"17701626-789a-4c4e-9f53-54bcfee671ea","resolution":{"observed_at":"2026-07-10T12:27:04.222114Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"8606.356064","doi":"10.1145/3548606.3560641","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":null,"venue":"Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security","work_id":"8de80ab1-2774-4b56-9025-af459e03af81","year":2022},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:d30ccad182fae67054ed96bf6b66ab7e68c672040440f23d0f20216e736b42b2","observation_id":"8e8d4b0c-b21f-40a9-9a74-678b1c51ef98","resolution":{"observed_at":"2026-07-10T12:27:04.122061Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.418878Z","title":null,"venue":null,"work_id":"4cef9953-9e21-48e0-9dc7-f45e01c1c2d8","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:4ba5159b7456694f589bcd47a9b7750161fb980b8e8a734407524ef5158d3f9e","observation_id":"20dd7db3-5ea4-415d-b30f-29e01c6cf4ca","resolution":{"observed_at":"2026-07-10T12:27:04.419983Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.417369Z","title":null,"venue":null,"work_id":"7a2c4737-d418-46a7-a223-3feeb4a475e5","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:1fb495e9525448048bf2816b86956b30a37a79a6bec3c098dc92fb785150157b","observation_id":"494ff69d-8bb1-4415-b94c-e1a88d88592a","resolution":{"observed_at":"2026-07-10T12:27:04.418383Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.462180Z","title":null,"venue":null,"work_id":"b0e8d30a-f00a-46af-9d45-aa9d6df624a2","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:cda062480b9e08b9f7ec08ee416de9b6a5c77d43056c89564f0332549c64558d","observation_id":"254f794a-d47d-4e97-95d5-73f8db1c3d4c","resolution":{"observed_at":"2026-07-10T12:27:04.463371Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.415896Z","title":null,"venue":null,"work_id":"efcff4ef-0980-4791-a760-3c96f9feb3d8","year":2022},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:a4acdac2d7cda3161501d6ea1a3ef68e64bc16455d3727ba8a30132acc08e42f","observation_id":"c681dc94-a2db-4778-9b37-264705c01290","resolution":{"observed_at":"2026-07-10T12:27:04.416894Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.463824Z","title":null,"venue":null,"work_id":"d7d08f74-a552-42d5-a281-f67d3258ad71","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:bbfca070a19cf46a38c023b8866a854c8891d3e5c9a54ecf026ba5442024d6c8","observation_id":"85dc5f5a-4993-45bb-b021-a405f594eb0a","resolution":{"observed_at":"2026-07-10T12:27:04.464783Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"1975.9939","doi":"10.1109/proc.1975.9939","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Saltzer and M.D","venue":"Proceedings of the IEEE","work_id":"d9338ce1-d72f-4364-aa66-010938e40de4","year":1975},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:56f25d03bb0f2967b330af9a456ff0a2d4d20a24fdf69cb980a9e85634028cd7","observation_id":"ad541f5c-7ebf-457f-bab0-461e31634381","resolution":{"observed_at":"2026-07-10T12:27:04.131792Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-07-12T05:19:16.628362+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-12T05:19:16.628362+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.19793","last_updated":"2025-08-24T03:28:21Z","snapshot_observed_at":"2026-08-14T15:35:38.720321Z","submitted_at":"2025-04-28T13:36:43Z","title":"Prompt Injection Attack to Tool Selection in LLM Agents","version":3},"cited_work":{"arxiv_id":"2504.19793","doi":"10.48550/arxiv.2504.19793","metadata_source":"pith","pith_arxiv_id":"2504.19793","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Prompt Injection Attack to Tool Selection in LLM Agents","venue":"cs.CR","work_id":"0224da95-0f8f-4479-bb4e-602bec01d31c","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2504.19793","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:e67660b89783dba0363df81364616f9165b18e5c1072646924511abeda75552c","observation_id":"c54ba00b-4323-4ba8-9389-33e17707c647","resolution":{"observed_at":"2026-07-10T12:27:04.091495Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.11703","last_updated":"2026-05-14T02:36:38Z","snapshot_observed_at":"2026-08-17T13:35:14.591010Z","submitted_at":"2025-04-16T01:58:40Z","title":"Progent: Securing AI Agents with Privilege Control","version":3},"cited_work":{"arxiv_id":"2504.11703","doi":"10.48550/arxiv.2504.11703","metadata_source":"pith","pith_arxiv_id":"2504.11703","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Progent: Securing AI Agents with Privilege Control","venue":"cs.CR","work_id":"193d98f2-c913-4d0c-814e-b550a64bd03c","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2504.11703","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:b6e226f25c05cbab947a4386b9b39c03e8e40aa4e7e139945f55c2185cfab9fd","observation_id":"e5f45ecf-29d2-411b-ad54-07be45a7b9c3","resolution":{"observed_at":"2026-07-10T12:27:04.219857Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2410.03055","doi":"10.48550/arxiv.2410.03055","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Permissive information-flow analysis for large language models","venue":"arXiv (Cornell University)","work_id":"35337530-a9a4-47c2-8e10-c246296ade56","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:ef4efbdd73f7b4f32e26a043e88d353c46cc2b9b6d5d04fc2da080cd076a3ca2","observation_id":"9a1f4561-8eab-4941-80f5-7d97e8cb4a52","resolution":{"observed_at":"2026-07-10T12:27:04.134278Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.467257Z","title":null,"venue":null,"work_id":"06f022f2-4685-4b11-ae20-dac3944be3d2","year":null},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:0e9e306a67622b1a81e7aa43a8269c92ddb2f0ab0b468a16a664c02c01f9c3fd","observation_id":"cfa8d287-1809-4204-9775-f8d971f0e754","resolution":{"observed_at":"2026-07-10T12:27:04.468285Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.465282Z","title":"In23rd USENIX Security Symposium","venue":null,"work_id":"1af29a3d-308b-474e-9505-30ca7fde52e4","year":null},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:88554dc1f4dc96caa7b80c0de84948e5bd7fbc5fda7b25243d2ddbb0f25c11c0","observation_id":"737caae7-e131-4865-b120-83794369873e","resolution":{"observed_at":"2026-07-10T12:27:04.466504Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.09222","doi":"10.48550/arxiv.2602.09222","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Muzzle: Adaptive agentic red-teaming of web agents against indirect prompt injection attacks","venue":"Open MIND","work_id":"4d2527e1-2167-4813-a66a-6b86ed646102","year":2026},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:c8cbf294a66231de65c7944cb560009f0e7c2f9f1b4c77ba426b3726e51eecff","observation_id":"05047864-36a8-4ff6-96fa-7ecc5a30f9e7","resolution":{"observed_at":"2026-07-10T12:27:04.137158Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.414434Z","title":null,"venue":null,"work_id":"8cfedced-a5aa-4c52-ada6-66e00fa50aee","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:70c2fc83e93d32843759caf121f7805053325cccba87515afa52380a18e93794","observation_id":"102d94c4-3dd0-492e-9b55-2fe3bd25ccd0","resolution":{"observed_at":"2026-07-10T12:27:04.415419Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"3082.373037","doi":"10.1145/3713082.3730377","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Several-Dream9346","venue":null,"work_id":"18465ff0-f2fb-40f2-828f-e55c6bb2c212","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:027e9ce3609e005e3c0ff1490c15390448cf93ea6e33531606c996d9421e2c79","observation_id":"3015d79e-0d7e-4d34-bc59-f64bed6703a5","resolution":{"observed_at":"2026-07-10T12:27:04.095082Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-07-14T04:20:19.807698+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-14T04:20:19.807698+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.412850Z","title":null,"venue":null,"work_id":"65509c5a-6e47-4d20-bef0-895b5132635e","year":2007},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:62aaa2b0753fa5a70c2a0a8846b56bb5feda0fcab736ceae26986c65702d6a3f","observation_id":"280721ae-b7db-4420-ad02-43e5cd1243b0","resolution":{"observed_at":"2026-07-10T12:27:04.413930Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-11T23:45:02.178667Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":"2404.13208","doi":"10.48550/arxiv.2404.13208","metadata_source":"pith","pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","venue":"cs.CR","work_id":"ba941a96-eb3b-48c0-b52c-5e9463085190","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:1358dfa47147381f33a2e9d7f41873bb2f219d87d3f3b46e1c9096538883826d","observation_id":"e3f2e3fa-8e8d-43ad-9396-f7c8d468f808","resolution":{"observed_at":"2026-07-10T12:27:04.239160Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"cited_work":{"arxiv_id":"2505.21499","doi":"10.48550/arxiv.2505.21499","metadata_source":"pith","pith_arxiv_id":"2505.21499","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","venue":"cs.CR","work_id":"926d73c7-2e9a-49ed-9d71-de95de53b62e","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2505.21499","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:23f004b7fcbadeb9373894c32eba8d1fffa72766b7807dc05e412931a1bfdd79","observation_id":"593f5839-afb9-4175-822f-a50c9e2e8399","resolution":{"observed_at":"2026-07-10T12:27:04.139949Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.468788Z","title":null,"venue":null,"work_id":"5701ca69-5daa-49a0-b635-b25c6977e636","year":2026},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:5ec0673b8089179c3947bf5d5e196734d030839b63001472d9bbd3838a2ecc0d","observation_id":"efe5319e-c2a5-4ea8-9d4a-fd3e9f94bf1b","resolution":{"observed_at":"2026-07-10T12:27:04.469758Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"4647.368109","doi":"10.1145/3664647.3681092","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"naacl-long.360/","venue":null,"work_id":"5727f7fa-bf76-42de-8958-4e44acd09e6c","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:eeed00c3b9859c79ba28c05f5a12e7bf549fb184767b651ed9ddd136ad1cfcee","observation_id":"aa747bc6-6c7f-4daa-85c4-e0f56b167321","resolution":{"observed_at":"2026-07-10T12:27:04.068851Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2505.11717","doi":"10.48550/arxiv.2505.11717","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Envinjection: Environmental prompt injection attack to multi-modal web agents","venue":"ArXiv.org","work_id":"0b30e81d-9900-4521-8cf2-b675fffb70b5","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:e43ddb402c19c20db505fcfbe501a6a7cee9fc718573a304721b968ce3c775da","observation_id":"5a419fc8-8061-47c1-ae80-015b7a8ff266","resolution":{"observed_at":"2026-07-10T12:27:04.142914Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.03792","doi":"10.48550/arxiv.2602.03792","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Websentinel: Detecting and localizing prompt injection attacks for web agents","venue":"Open MIND","work_id":"31bc43a1-b221-4de8-bbfc-92f9cb33e296","year":2026},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":80,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:d63e2f50ae0709cff4acbcc80a39628d3e5e0f4ce2adea9d632e7b1182a5d3e7","observation_id":"be2cbff8-bb01-46ab-b495-6eed47a6abd2","resolution":{"observed_at":"2026-07-10T12:27:04.146129Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2409.07429","last_updated":"2024-09-11T17:21:00Z","snapshot_observed_at":"2026-08-15T11:12:59.718423Z","submitted_at":"2024-09-11T17:21:00Z","title":"Agent Workflow Memory","version":1},"cited_work":{"arxiv_id":"2409.07429","doi":"10.48550/arxiv.2409.07429","metadata_source":"pith","pith_arxiv_id":"2409.07429","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Agent Workflow Memory","venue":"cs.CL","work_id":"c81e2e3e-49d4-46f5-9a82-76e8d00fef1d","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":81,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2409.07429","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:a90a43179049ad8ed32e8d40add60b97b176ea16c502164c789fe93a3ae87c22","observation_id":"4284a130-0cc6-49e4-ac64-3454b577a0c2","resolution":{"observed_at":"2026-07-10T12:27:04.214500Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-01T10:08:10.022945+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-01T10:08:10.022945+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.04885","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.242708Z","title":"Rl is a hammer and llms are nails: A simple reinforcement learning recipe for strong prompt injection","venue":null,"work_id":"012836ea-5c24-47f7-87e9-9bb30f4c9069","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":82,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:b6c8a1c011cb514165d818ea03fc6232970a6822c0ed4f92994d27d4fc20a909","observation_id":"c6df2688-65a4-4c48-ab96-34c4ff7fd75b","resolution":{"observed_at":"2026-07-10T12:27:04.244307Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.409394Z","title":null,"venue":null,"work_id":"f13ead07-a496-4ba1-83ff-75acdcfea0e0","year":2023},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":83,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:8e751772ae0d5ca1b249d3a90c456b763fb20bc0c8f51b6d534df68375c808cf","observation_id":"1b60801b-a6aa-42d3-b24f-b11d4d71a40a","resolution":{"observed_at":"2026-07-10T12:27:04.410485Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.470212Z","title":null,"venue":null,"work_id":"e7d6fc18-c301-4ac0-8967-5951466ec64e","year":2023},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":84,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:3487e1405b11fed5549215d66e9a42f3b685d443a650ed9c3e25fbcd467164e1","observation_id":"d3ec3667-e441-40ec-9399-ccafe6926c71","resolution":{"observed_at":"2026-07-10T12:27:04.471211Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2409.19091","last_updated":"2024-10-10T15:29:07Z","snapshot_observed_at":"2026-08-18T16:25:23.964035Z","submitted_at":"2024-09-27T18:41:58Z","title":"System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective","version":2},"cited_work":{"arxiv_id":"2409.19091","doi":null,"metadata_source":"pith","pith_arxiv_id":"2409.19091","snapshot_observed_at":"2026-07-10T12:27:04.230184Z","title":"System-level defense against indirect prompt injection attacks: An information flow control perspective","venue":"cs.CR","work_id":"c3786d6b-d1c5-4d79-af2c-1215479ed680","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":85,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2409.19091","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:9a65be142af7f71ff26a912339120225ecf50932872496d3689c037f2f538427","observation_id":"35dc037d-3251-4c14-b2a4-73943c510597","resolution":{"observed_at":"2026-07-10T12:27:04.231363Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2601.07263","doi":"10.48550/arxiv.2601.07263","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"When Bots Take the Bait: Exposing and Mitigating the Emerging Social Engineering Attack in Web Automation Agent,","venue":"arXiv (Cornell University)","work_id":"1ae4aab4-2116-47a9-895f-3b9f36a53b7d","year":2026},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":86,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:d009e25e6a2f0d78bf263835e1809d881f7ebced167e6a9e0f0976372b7183c4","observation_id":"cb960af1-81a6-4e98-a54a-079faccbfd01","resolution":{"observed_at":"2026-07-10T12:27:04.103712Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.404724Z","title":null,"venue":null,"work_id":"9b9330d8-97d4-45b0-a402-93a6756568a4","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":87,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:9763cecf234756a91d070fe39a00de201e06b43a3ff76450594e19c8a8859953","observation_id":"2fe81d14-9813-4695-9bb3-4a11d27154d1","resolution":{"observed_at":"2026-07-10T12:27:04.405672Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.17401","last_updated":"2025-05-31T18:34:01Z","snapshot_observed_at":"2026-08-20T00:46:45.942018Z","submitted_at":"2024-10-22T20:18:26Z","title":"AdvAgent: Controllable Blackbox Red-teaming on Web Agents","version":4},"cited_work":{"arxiv_id":"2410.17401","doi":null,"metadata_source":"pith","pith_arxiv_id":"2410.17401","snapshot_observed_at":"2026-07-10T12:27:04.225516Z","title":"Ad- vweb: Controllable black-box attacks on vlm-powered web agents","venue":"cs.CR","work_id":"2a343e0b-c7ca-43e4-a88b-e942d6efea85","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":88,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2410.17401","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:5a7bcd97d5277885ccda1dcb0736439ced599c705e636e48fc6a625a414a7e16","observation_id":"c9a13f31-a8b4-478e-9db2-77d30dd93cac","resolution":{"observed_at":"2026-07-10T12:27:04.226700Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.403274Z","title":"Xu, Yufan Song, Boxuan Li, et al","venue":null,"work_id":"43f34da0-686e-4e71-adb5-f6e1bde60e0b","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":89,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:b382bb5b8ddc34c2e752653bd89d27d416e7caeb69274c344b101f682dfd4c83","observation_id":"12d728dd-dcde-49c6-9955-2f216d931798","resolution":{"observed_at":"2026-07-10T12:27:04.404226Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"6277.274165","doi":"10.1145/2736277.2741650","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":null,"venue":null,"work_id":"71e6c632-1409-49cf-a565-c366d5d2375e","year":2015},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":90,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:297122feaff7f80d00682af42cdaeaeb75c16471488c39c8e55a24a664858c2e","observation_id":"41439c36-a94e-403d-939f-c818d5b6d2c8","resolution":{"observed_at":"2026-07-10T12:27:04.052187Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.401531Z","title":null,"venue":null,"work_id":"1ffdffea-2da0-453b-819f-1bdb9fabae2c","year":null},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":91,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:d9b043d3bd4e692299b4a3825ba1c533b677439250b462374420e4b3f6ea59fa","observation_id":"5f1f778f-518f-417c-89f8-17ceac40fee6","resolution":{"observed_at":"2026-07-10T12:27:04.402792Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.11441","last_updated":"2023-11-06T07:39:49Z","snapshot_observed_at":"2026-08-12T21:25:32.312122Z","submitted_at":"2023-10-17T17:51:31Z","title":"Set-of-Mark Prompting Unleashes Extraordinary Visual Grounding in GPT-4V","version":2},"cited_work":{"arxiv_id":"2310.11441","doi":"10.48550/arxiv.2310.11441","metadata_source":"pith","pith_arxiv_id":"2310.11441","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Set-of-Mark Prompting Unleashes Extraordinary Visual Grounding in GPT-4V","venue":"cs.CV","work_id":"ddc8878e-ed0c-4a66-952a-254dce1c622a","year":2023},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":92,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2310.11441","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:92e54553b8f56a6f41d38d36502b7e281f86e8f3d44ce5f5952a6b1293c223b0","observation_id":"694bbf41-e247-41b9-ad6e-701bbca72553","resolution":{"observed_at":"2026-07-10T12:27:04.234120Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-15T07:08:14.314628+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-15T07:08:14.314628+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.13825","last_updated":"2025-05-24T03:55:22Z","snapshot_observed_at":"2026-08-18T10:17:03.835277Z","submitted_at":"2024-10-17T17:50:38Z","title":"AgentOccam: A Simple Yet Strong Baseline for LLM-Based Web Agents","version":2},"cited_work":{"arxiv_id":"2410.13825","doi":null,"metadata_source":"pith","pith_arxiv_id":"2410.13825","snapshot_observed_at":"2026-07-10T12:27:04.223243Z","title":"Agentoccam: A sim- ple yet strong baseline for llm-based web agents","venue":"cs.AI","work_id":"cfabb93e-6ac9-4c7e-ba4c-8b75487c92cb","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":93,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2410.13825","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:b15fc5a026c80305b47a29e8c11b1a0ff2e3aaaa08676958481afcc8f088a7d2","observation_id":"ab21f29e-908f-42b6-ac87-4314f602e0c3","resolution":{"observed_at":"2026-07-10T12:27:04.224423Z","resolver_source":"local_arxiv","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.09241","last_updated":"2025-03-12T10:38:15Z","snapshot_observed_at":"2026-08-19T20:26:19.678570Z","submitted_at":"2025-03-12T10:38:15Z","title":"In-Context Defense in Computer Agents: An Empirical Study","version":1},"cited_work":{"arxiv_id":"2503.09241","doi":"10.48550/arxiv.2503.09241","metadata_source":"pith","pith_arxiv_id":"2503.09241","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"In-context defense in computer agents: An empirical study","venue":"cs.AI","work_id":"f82c2050-1efb-4bc6-8966-30a08781b78a","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":94,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2503.09241","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:08e813398becc6ec0e254d610266053a4ca00db23ac00a8662c9826cc86bed11","observation_id":"4c0466ee-3251-48fd-9c94-74ce26b92cab","resolution":{"observed_at":"2026-07-10T12:27:04.106680Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:27:04.400033Z","title":null,"venue":null,"work_id":"5dd6023b-058f-41f3-8852-de3d21cd3446","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:6557fe429b0be198b6a8337103dbf9b528e905f4ddfea77a8bc9d4163da738dd","observation_id":"236b8136-c51f-4c14-bb1e-30bb05ab5cdf","resolution":{"observed_at":"2026-07-10T12:27:04.401084Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.18653/v1/2025.findings-naacl.395","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"ISBN 979-8-89176-195-7","venue":null,"work_id":"0d6fe9fd-67ba-4433-90e3-013c0a68a18b","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":96,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:ea3721b3eada652dd88071d470b9d9a28729dea93f827abee7984943e8dbf051","observation_id":"9bdea333-236e-45d2-a5cd-346eb16398e7","resolution":{"observed_at":"2026-07-10T12:27:04.126725Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-13T19:08:32.875001+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-13T19:08:32.875001+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2511.20597","last_updated":"2026-08-12T00:08:22Z","snapshot_observed_at":"2026-08-15T23:09:13.298804Z","submitted_at":"2025-11-25T18:28:35Z","title":"BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents","version":2},"cited_work":{"arxiv_id":"2511.20597","doi":"10.48550/arxiv.2511.20597","metadata_source":"arxiv_reference","pith_arxiv_id":"2511.20597","snapshot_observed_at":"2026-08-13T01:24:45.972029Z","title":"Browsesafe: Understanding and preventing prompt injection within ai browser agents","venue":"ArXiv.org","work_id":"a0d67379-2d33-454a-adc9-f11a80f22f99","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":97,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2511.20597","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:a15b55461582220638a9c86343572fceba63e0d4b42e9d0ce5f985a314057a22","observation_id":"6267cd72-2123-43bd-a78a-12204f61f320","resolution":{"observed_at":"2026-08-13T01:24:45.972029Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15978","last_updated":"2024-08-28T17:49:29Z","snapshot_observed_at":"2026-08-16T13:23:07.854251Z","submitted_at":"2024-08-28T17:49:29Z","title":"WebPilot: A Versatile and Autonomous Multi-Agent System for Web Task Execution with Strategic Exploration","version":1},"cited_work":{"arxiv_id":"2408.15978","doi":"10.48550/arxiv.2408.15978","metadata_source":"pith","pith_arxiv_id":"2408.15978","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Webpilot: A versatile and autonomous multi-agent system for web task exe- JOURNAL OF LATEX CLASS FILES, DECEMBER 2024 92 cution with strategic exploration","venue":"cs.AI","work_id":"b5a9c702-286e-4dbd-9a82-3dcaa7812dec","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":98,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2408.15978","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:17264b6f126e996e0a8da5afc5398e4b8bd2dc71994b6fecff7d8ea2b704f970","observation_id":"2d2a1655-e1e4-4da2-b4e9-fa2f64318076","resolution":{"observed_at":"2026-07-10T12:27:04.079680Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2411.02391","last_updated":"2025-05-24T16:15:46Z","snapshot_observed_at":"2026-08-16T13:03:02.879460Z","submitted_at":"2024-11-04T18:56:42Z","title":"Attacking Vision-Language Computer Agents via Pop-ups","version":2},"cited_work":{"arxiv_id":"2411.02391","doi":"10.48550/arxiv.2411.02391","metadata_source":"pith","pith_arxiv_id":"2411.02391","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Attacking vision- language computer agents via pop-ups","venue":"cs.CL","work_id":"74121ae8-d170-456a-86e7-6590edee179a","year":2024},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":99,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2411.02391","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:c72ef35a90062dde9d65d5626e9e38c41a7107f6497646156ac7fa64836f9acf","observation_id":"e4cb4ee9-5f1b-4149-9cf8-5b7143bff42b","resolution":{"observed_at":"2026-07-10T12:27:04.206424Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2507.14293","last_updated":"2025-07-18T18:06:27Z","snapshot_observed_at":"2026-08-20T02:31:40.859214Z","submitted_at":"2025-07-18T18:06:27Z","title":"WebGuard: Building a Generalizable Guardrail for Web Agents","version":1},"cited_work":{"arxiv_id":"2507.14293","doi":"10.48550/arxiv.2507.14293","metadata_source":"pith","pith_arxiv_id":"2507.14293","snapshot_observed_at":"2026-07-10T18:15:00.821465Z","title":"Webguard: Building a generalizable guardrail for web agents","venue":"cs.AI","work_id":"0fe67f59-aa4e-4588-844e-53c56b0bee61","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":100,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2507.14293","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:504766e23758b5b62deb060b31e17511d1cbb17b36c1d75c53b109697819f926","observation_id":"e33b4044-cd5d-4fb9-a931-f3dfbcbf16fe","resolution":{"observed_at":"2026-07-10T12:27:04.085771Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents"},"reference_resolution":{"displayed":100,"state_counts":{"malformed_identifier":1,"metadata_mismatch":5,"parse_uncertain":0,"unresolved":37,"verified_exact":49,"verified_fuzzy":8},"total_outbound_references":106},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"thesis":"As of 21 August 2026, this Paper Citation Record lists 100 of 106 outbound references and 0 inbound Pith citation observations for arXiv:2607.08147."}