{"as_of":"2026-08-20T08:26:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:29977bb5b4cb022ff3679d2bcea88696ebae0b4086c1a41e283f2bda12b2f870","coverage":[{"denominator":46,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":46,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-10T08:08:21.077290Z","state":"measured"},{"denominator":46,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":46,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-20T06:33:59.587034+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.08395/citation-record","integrity":"/paper/2607.08395/integrity","json":"/paper/2607.08395/citation-record.json","paper":"/paper/2607.08395"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T03:47:52.350337Z","title":"Aho and Jeffrey D","venue":null,"work_id":"b1f5cb43-a3c7-4ea0-85e7-9ccc9dfe1588","year":1972},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:9fa74fd7d12a1e12699cc5f3db9a34aa2ea784a657cd7ff4f58b6474f18b4f20","observation_id":"e6ff9423-36de-467c-aa3e-927d60eeab20","resolution":{"observed_at":"2026-07-10T08:16:59.504710Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T03:47:52.146752Z","title":null,"venue":null,"work_id":"aca2b566-99e0-4ebb-9c7a-a81219531259","year":1983},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:3fbe5ad2fa0d594c4add778ce0cb4d25291803ded3f83fc4025e766d7f644315","observation_id":"2f51def9-93c5-414b-b32f-55393c1a6791","resolution":{"observed_at":"2026-07-10T08:16:59.481808Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2234.322243","doi":"10.1145/322234.322243","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Chandra and Dexter C","venue":"Journal of the ACM","work_id":"c3270592-bd69-4213-95e1-4aaf8312be9b","year":1981},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:a913d0d91a7fdf264204aabfe660ff32150b7bc43ddef4866396af182a4117c9","observation_id":"ded25281-05bc-4c49-9945-8acda74d7277","resolution":{"observed_at":"2026-07-10T08:16:58.750621Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-07-18T08:21:12.175602+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-18T08:21:12.175602+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T03:47:52.206662Z","title":"Scalable training of","venue":null,"work_id":"aef70eae-f816-4598-84ec-429a2c09f5fc","year":null},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:ea73b0184ed1de8866006913fe0e6de6ba2b61266eec32adbcde0d7dda6c3ce8","observation_id":"d4745412-3b17-46a6-b353-588e525b16d3","resolution":{"observed_at":"2026-07-10T08:16:59.485506Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T03:47:52.062642Z","title":null,"venue":null,"work_id":"852d89f5-1e7b-4296-b4f2-71e578b5e9f6","year":1997},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:c51987d0334ecb7d9671d5f6403e9cdc81d6b12cad46aa1a7344f86fbcf9904f","observation_id":"27d94936-333e-4db6-9e0c-cd87cdd3bc59","resolution":{"observed_at":"2026-07-10T08:16:59.487284Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T03:47:52.089088Z","title":"Tetreault , title =","venue":null,"work_id":"75f57f43-cb6d-44a9-9cc5-9b8cfc702ea3","year":2015},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:47285e892ecbee36944ffd1d3bbabb2b8722e021f8a81bba7ffdc32ae67420d6","observation_id":"f8aa2823-63fa-4362-90a0-244f608d4399","resolution":{"observed_at":"2026-07-10T08:16:59.489139Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T03:47:52.117121Z","title":"A Framework for Learning Predictive Structures from Multiple Tasks and Unlabeled Data , Volume =","venue":null,"work_id":"6d196829-7173-4c45-aa5c-d0ee30947345","year":null},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:66f51fd3e2ff340a8c38aa4035fa40424433d8c2edc0f3d00f6ae3f9e5c3af69","observation_id":"047cce80-0f3b-482c-b597-45704162b827","resolution":{"observed_at":"2026-07-10T08:16:59.483762Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.15817","last_updated":"2024-05-17T17:17:45Z","snapshot_observed_at":"2026-07-06T16:24:30.545494Z","submitted_at":"2023-09-25T17:08:02Z","title":"Identifying the Risks of LM Agents with an LM-Emulated Sandbox","version":2},"cited_work":{"arxiv_id":"2309.15817","doi":"10.48550/arxiv.2309.15817","metadata_source":"pith","pith_arxiv_id":"2309.15817","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Identifying the Risks of LM Agents with an LM-Emulated Sandbox","venue":"cs.AI","work_id":"3d4c3b66-d749-4939-b1bc-62b10b2ebbb6","year":2023},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2309.15817","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:2f4e8e7257240f6fcd53f2a089708f37a64f8571fe1acb30e7dd7d59a9c0a294","observation_id":"212ad4b6-71d5-4adc-873f-fc770a77d76b","resolution":{"observed_at":"2026-07-10T08:16:58.820459Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:59.489679Z","title":"2024 , eprint =","venue":null,"work_id":"915d585b-6483-4840-bf1d-6a2f8f8ac57e","year":2024},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:12e38006a2d67eddd2622677de4ffd27defefc9490c50d03c8e0a8d4ebcafde0","observation_id":"87723374-d6fc-4cbb-8890-dbf9b39153ba","resolution":{"observed_at":"2026-07-10T08:16:59.494381Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.09024","last_updated":"2025-04-18T14:30:31Z","snapshot_observed_at":"2026-08-16T05:17:43.289570Z","submitted_at":"2024-10-11T17:39:22Z","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","version":3},"cited_work":{"arxiv_id":"2410.09024","doi":"10.48550/arxiv.2410.09024","metadata_source":"pith","pith_arxiv_id":"2410.09024","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","venue":"cs.LG","work_id":"788aad10-421f-48d7-886c-792665914606","year":2024},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2410.09024","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:650fa7d8c821b9e6aa9f5e482bd5c27adfebb0fb8f3b46dbf3da9209ea5d7748","observation_id":"a9298767-e182-4f4e-9cfa-461130500f4c","resolution":{"observed_at":"2026-07-10T08:16:58.802131Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.14470","last_updated":"2025-05-20T05:58:23Z","snapshot_observed_at":"2026-08-06T12:35:19.109481Z","submitted_at":"2024-12-19T02:35:15Z","title":"Agent-SafetyBench: Evaluating the Safety of LLM Agents","version":2},"cited_work":{"arxiv_id":"2412.14470","doi":"10.48550/arxiv.2412.14470","metadata_source":"pith","pith_arxiv_id":"2412.14470","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Agent-SafetyBench: Evaluating the Safety of LLM Agents","venue":"cs.CL","work_id":"96afb8b9-0e7e-442c-93b1-6638599fc041","year":2024},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2412.14470","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:1f2ae728e9982c34b1d012731a7a18789f4ebfe932dd117d546529fe473093fe","observation_id":"35361c3d-507e-4b66-9ff5-9a6b72856d28","resolution":{"observed_at":"2026-07-10T08:16:58.826196Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-07-14T18:20:24.185748+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-14T18:20:24.185748+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2302.12173","last_updated":"2023-05-05T14:26:17Z","snapshot_observed_at":"2026-08-12T14:45:22.117576Z","submitted_at":"2023-02-23T17:14:38Z","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","version":2},"cited_work":{"arxiv_id":"2302.12173","doi":"10.1109/sp61157.2025.00250","metadata_source":"pith","pith_arxiv_id":"2302.12173","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","venue":"cs.CR","work_id":"7a8cfce1-ada7-4a7a-8516-6f16b1bd077b","year":2023},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2302.12173","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:7db3cc74aaedd23de622062e2183fd0c17f6d7062bc29bca57f80f04d1b18ad7","observation_id":"2e336d02-53eb-4e4d-9b4a-baf42fdeee37","resolution":{"observed_at":"2026-07-10T08:16:58.842522Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:59.500203Z","title":"and Pinto, Jeremy and Khan, Anaum and Bouchard, Louis-Fran","venue":null,"work_id":"8201c942-5124-41ef-931b-5b502b0da527","year":2023},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:b64b4f3a2317a1be59bc5b2cb7fd6facac74874f293456af9ba0dd16dcd44707","observation_id":"93c5e2e3-aec8-47d6-abf0-e26a4782052f","resolution":{"observed_at":"2026-07-10T08:16:59.501358Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:59.474028Z","title":"2023 , eprint =","venue":null,"work_id":"148b7827-504b-49f6-8c89-5c78ff7ac926","year":2023},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:90d5003f57ff20c9000fe51add9a52bbd187e95fd1e981d893fdc7720cdce6a3","observation_id":"de04a218-7489-443c-b873-1295874f59fb","resolution":{"observed_at":"2026-07-10T08:16:59.475079Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:59.475606Z","title":"2024 , archivePrefix =","venue":null,"work_id":"fbf8ecc7-1cd1-44c7-83be-962cc936b871","year":2024},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:f17190c7aec22155d641839d2bae5d706d7f4d83f81ade6e1c3ccf34dced84cd","observation_id":"edc79d56-99de-4c69-826c-e5293eb9ed9c","resolution":{"observed_at":"2026-07-10T08:16:59.476733Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.06363","last_updated":"2024-09-25T19:48:39Z","snapshot_observed_at":"2026-08-19T16:46:32.130363Z","submitted_at":"2024-02-09T12:15:51Z","title":"StruQ: Defending Against Prompt Injection with Structured Queries","version":2},"cited_work":{"arxiv_id":"2402.06363","doi":"10.48550/arxiv.2402.06363","metadata_source":"pith","pith_arxiv_id":"2402.06363","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Struq: Defending against prompt injection with structured queries","venue":"cs.CR","work_id":"5e57b942-26b0-4859-8393-c0fa2c2ad65b","year":2024},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2402.06363","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:91a2df2d3dddaaf9833040b810585051e63ec89e3ac6890db96b0f0b8c424c5f","observation_id":"78919c18-a2a0-4337-957f-b6d15cd09539","resolution":{"observed_at":"2026-07-10T08:16:58.817986Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-11T23:45:02.178667Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":"2404.13208","doi":"10.48550/arxiv.2404.13208","metadata_source":"pith","pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","venue":"cs.CR","work_id":"ba941a96-eb3b-48c0-b52c-5e9463085190","year":2024},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:447a592d4a330df98ddd82dfbcce54f444cf89a3a13da9ce6ae637a8637341be","observation_id":"b0d2471a-cb92-4ab3-b7b7-449b2c03e040","resolution":{"observed_at":"2026-07-10T08:16:58.837230Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.06674","last_updated":"2023-12-07T19:40:50Z","snapshot_observed_at":"2026-08-14T15:42:19.849118Z","submitted_at":"2023-12-07T19:40:50Z","title":"Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations","version":1},"cited_work":{"arxiv_id":"2312.06674","doi":"10.3390/info16050365","metadata_source":"pith","pith_arxiv_id":"2312.06674","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations","venue":"cs.CL","work_id":"93844332-869b-448c-a1be-35466150b1b2","year":2023},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2312.06674","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:07aab04a6f19d6120ca249ddebbbe213b464610a8770052880f958b69641437b","observation_id":"8307068c-9e34-4b53-a007-691be5f826ac","resolution":{"observed_at":"2026-07-10T08:16:58.834766Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.18653/v1/2023.emnlp-demo.40","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"N e M o Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails","venue":null,"work_id":"345f2355-04ff-4ebf-8263-f5d05bbd22bb","year":2023},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:86ece3b1f88c0f1be1a708692e1317473b52aed65a8a87d7f924a93a6e2e602f","observation_id":"5ad7d524-9616-467d-86b6-7f7de54617e2","resolution":{"observed_at":"2026-07-10T08:16:58.755987Z","resolver_source":"doi","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-10T00:38:22.65932+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-10T00:38:22.65932+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05685","last_updated":"2023-12-24T02:01:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-06-09T05:55:52Z","title":"Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena","version":4},"cited_work":{"arxiv_id":"2306.05685","doi":"10.1109/4235.797969","metadata_source":"pith","pith_arxiv_id":"2306.05685","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena","venue":"cs.CL","work_id":"d0c30cd7-81e1-4159-a87f-f6adca77ff08","year":2023},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2306.05685","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:a0892b87779455360f6300baad550f427d408b44d7ac04d6414593050d6e5bf0","observation_id":"2f4713cf-d49c-4c79-8e16-59eb00ebb682","resolution":{"observed_at":"2026-07-10T08:16:58.799445Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2303.16634","last_updated":"2023-05-23T22:12:16Z","snapshot_observed_at":"2026-08-02T04:02:36.848064Z","submitted_at":"2023-03-29T12:46:54Z","title":"G-Eval: NLG Evaluation using GPT-4 with Better Human Alignment","version":3},"cited_work":{"arxiv_id":"2303.16634","doi":"10.48550/arxiv.2303.16634","metadata_source":"pith","pith_arxiv_id":"2303.16634","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"G-Eval: NLG Evaluation using GPT-4 with Better Human Alignment","venue":"cs.CL","work_id":"6bc7f654-ec90-4d95-b023-416717a28f45","year":2023},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2303.16634","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:25f8204e3de6a8254c84abe0de6b5d4439dd43ee32a17ad86bb28565b568d5df","observation_id":"42dda8c5-ef59-480f-a63d-b193e5386289","resolution":{"observed_at":"2026-07-10T08:16:58.811903Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-05-20T14:22:05.615976+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-20T14:22:05.615976+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-08-11T04:23:46.286452Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:aab711747da22d11ceb05dfa8e1c87aa98ed4b9e963ed5358d4c219938bb44d7","observation_id":"15392d6f-5a54-41cf-8448-3330a8117018","resolution":{"observed_at":"2026-07-10T08:16:58.839855Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T03:57:49.354409Z","title":"2023 , url =","venue":null,"work_id":"b2b827a3-337f-447e-8f8a-61b35d39f72d","year":2023},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:96b420f9751ad41b3f7259916e7742228caa974f6efeeb69d8762288b5043cc5","observation_id":"67af150f-91ec-4ada-8b7f-1468dc7adce1","resolution":{"observed_at":"2026-07-10T08:16:59.471828Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:59.479051Z","title":"2023 , url =","venue":null,"work_id":"f603c8d9-63ad-442f-9b29-bf8d6d09d6d7","year":2023},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:72a2561e6959be71d32ccaabc78392e993b42167b0ae4349cd85d6113d2c8240","observation_id":"6656da4c-d36b-443a-a95b-d9f7ab9a934d","resolution":{"observed_at":"2026-07-10T08:16:59.480128Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"6183.360676","doi":"10.1145/3586183.3606763","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"O'Brien and Carrie Jun Cai and Meredith Ringel Morris and Percy Liang and Michael S","venue":null,"work_id":"b5bf85fe-4fb7-4966-b0b2-9ccf9d3b11b9","year":2023},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:a76e9c140a5dfcb534fa8ed86311038ea4b48d4fb4c62ca524bdf1c31e912485","observation_id":"5ed95c6a-6115-4749-9d13-7437a80653b7","resolution":{"observed_at":"2026-07-10T08:16:58.753704Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-07-18T08:21:12.695495+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-18T08:21:12.695495+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2305.16291","last_updated":"2023-10-19T16:27:03Z","snapshot_observed_at":"2026-08-13T16:55:46.498156Z","submitted_at":"2023-05-25T17:46:38Z","title":"Voyager: An Open-Ended Embodied Agent with Large Language Models","version":2},"cited_work":{"arxiv_id":"2305.16291","doi":"10.18653/v1/2023.emnlp-main.118","metadata_source":"pith","pith_arxiv_id":"2305.16291","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Voyager: An Open-Ended Embodied Agent with Large Language Models","venue":"cs.AI","work_id":"ffe0d207-86cf-4742-a100-e988ac8b9676","year":2023},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2305.16291","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:f2fcf33e80f787b0cf2e00bf09f92a337fa02aabd29a03c7a21033bfde474c38","observation_id":"76313bb9-8deb-444d-b9ae-012b07def7bf","resolution":{"observed_at":"2026-07-10T08:16:58.823571Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.03574","last_updated":"2025-05-06T14:34:21Z","snapshot_observed_at":"2026-08-20T00:59:59.722874Z","submitted_at":"2025-05-06T14:34:21Z","title":"LlamaFirewall: An open source guardrail system for building secure AI agents","version":1},"cited_work":{"arxiv_id":"2505.03574","doi":"10.48550/arxiv.2505.03574","metadata_source":"pith","pith_arxiv_id":"2505.03574","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Llamafirewall: An open source guardrail system for building secure ai agents","venue":"cs.CR","work_id":"3f20ace2-8264-4a7e-94a4-94436bcc063a","year":2025},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2505.03574","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:cc10661c041a9248602e93ca1819370f4d1d5e3c38dbd99f2a97f2619a666c0d","observation_id":"aedee156-93bf-49b3-8835-a4d7916c0f03","resolution":{"observed_at":"2026-07-10T08:16:58.805108Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05499","last_updated":"2025-12-29T02:25:27Z","snapshot_observed_at":"2026-07-06T15:40:27.639368Z","submitted_at":"2023-06-08T18:43:11Z","title":"Prompt Injection attack against LLM-integrated Applications","version":3},"cited_work":{"arxiv_id":"2306.05499","doi":"10.48550/arxiv.2306.05499","metadata_source":"pith","pith_arxiv_id":"2306.05499","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Prompt Injection attack against LLM-integrated Applications","venue":"cs.CR","work_id":"977b4683-bba6-49d6-8f3d-496c41cb7fac","year":2023},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2306.05499","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:c18eaa8bfadc299ce8e17b3fc02db54e618c70fc669c9a5accfe5cf091b80a79","observation_id":"b5c5447c-1768-458d-a84a-12699ad9842c","resolution":{"observed_at":"2026-07-10T08:16:58.845736Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02691","last_updated":"2024-08-04T04:52:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-05T06:21:45Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","version":3},"cited_work":{"arxiv_id":"2403.02691","doi":"10.1145/3696410.3714756","metadata_source":"pith","pith_arxiv_id":"2403.02691","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","venue":"cs.CL","work_id":"5cbfcda4-ec26-44e4-be60-e1525956d71d","year":2024},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2403.02691","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:fd5e5319003f06cfc251fe7e804579f8764d58e3774ade98d7c473a3a926de7b","observation_id":"c3cf1fd7-def9-47f4-9bcd-4535e81c31d8","resolution":{"observed_at":"2026-07-10T08:16:58.848341Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:59.462842Z","title":"2023 , eprint =","venue":null,"work_id":"e57c5e56-6373-439a-8039-ae4483f2af5e","year":2023},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:0a74e9b82dde365ebb9fe311f453b42fcb365e25efcbc5c00c4d29d930bea043","observation_id":"f8f24a97-de4e-4a4b-bf1a-4aa51fdbb6fa","resolution":{"observed_at":"2026-07-10T08:16:59.463902Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2507.02735","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:58.857965Z","title":"Meta secalign: A secure foundation llm against prompt injection attacks","venue":null,"work_id":"69776aad-e4d1-4d24-bb01-59055547fa49","year":2025},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:9b664497b40962ba4f7e1e856aa814de3b0ec80745b766e9e69df23cfb61660d","observation_id":"55c2d5dd-8f7d-4980-baad-71197a5a1f51","resolution":{"observed_at":"2026-07-10T08:16:58.859830Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.24414","doi":"10.48550/arxiv.2603.24414","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, and Yang Liu","venue":"arXiv (Cornell University)","work_id":"dc2fea0e-6235-4a65-ac02-e36c9b96ee01","year":2026},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:75ddc3f0fc0b474e3deeaffa5ba5d5dff7b69308e5d0324ffbeee728d2127ca7","observation_id":"52af86bb-b290-478c-80e7-c339a5cf4386","resolution":{"observed_at":"2026-07-10T08:16:58.814859Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.19169","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:58.806563Z","title":"OpenGuardrails: A Configurable, Unified, and Scalable Guardrails Platform for Large Language Models","venue":null,"work_id":"94f361ff-7a0e-4945-a4b6-2d65774c52fc","year":2025},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:641b66580d8d921ad4d8a84c1a4db21f8d4a5b69ebb781ba1814631e66782631","observation_id":"83b1748d-5466-41c1-9175-e13dfae6ddec","resolution":{"observed_at":"2026-07-10T08:16:58.809134Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:59.477302Z","title":"Toward Securing","venue":null,"work_id":"9a589392-eced-451b-b721-6d6fb00ec74f","year":2026},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:ed380ad38d557fa7eeb27252c4c4b92b9aa0a7a3f4ed41e3a1f54fad9a325dfe","observation_id":"4edf4873-8aa1-4d96-aeab-faec9d7611b0","resolution":{"observed_at":"2026-07-10T08:16:59.478437Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:59.472468Z","title":"and Lombardo, J","venue":null,"work_id":"f4fd30bd-9df6-4f73-89cc-5d78e309705d","year":null},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:6f6410f40079538e4eae9b8c5ff95ae08beebf0dd3d9a41aef87b3f2ffe343f0","observation_id":"5837ba3d-d119-4d4e-9721-d90a4044c6b9","resolution":{"observed_at":"2026-07-10T08:16:59.473517Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2501.09674","last_updated":"2025-01-16T17:11:21Z","snapshot_observed_at":"2026-08-20T04:56:48.360693Z","submitted_at":"2025-01-16T17:11:21Z","title":"Authenticated Delegation and Authorized AI Agents","version":1},"cited_work":{"arxiv_id":"2501.09674","doi":"10.48550/arxiv.2501.09674","metadata_source":"pith","pith_arxiv_id":"2501.09674","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Authenticated delegation and authorized ai agents","venue":"cs.CY","work_id":"1182c8d2-0bc2-40cc-affb-db1ec9679a3c","year":2025},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2501.09674","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:16193f799d8c2f8509a1eb908da6a8ddb514c3db6eaa9bd43456a619a1d3b086","observation_id":"72da2104-17aa-418a-9a93-304d17119d3a","resolution":{"observed_at":"2026-07-10T08:16:58.831834Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.18658","last_updated":"2026-04-20T10:11:26Z","snapshot_observed_at":"2026-08-14T13:54:27.704154Z","submitted_at":"2026-04-20T10:11:26Z","title":"Owner-Harm: A Missing Threat Model for AI Agent Safety","version":1},"cited_work":{"arxiv_id":"2604.18658","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.18658","snapshot_observed_at":"2026-07-10T08:16:58.827525Z","title":"Owner-Harm: A Missing Threat Model for AI Agent Safety","venue":"cs.CR","work_id":"458d07aa-0dd5-42cc-b2c7-07cf1dae753d","year":2026},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2604.18658","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:a346650f8ce857754556524ce89e1ef1ee938959482655defef5493552304e79","observation_id":"93c07458-c99a-4d5b-b8d6-6341f4fd33e4","resolution":{"observed_at":"2026-07-10T08:16:58.828971Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.22868","last_updated":"2026-05-08T19:13:57Z","snapshot_observed_at":"2026-08-12T23:14:46.333754Z","submitted_at":"2026-03-24T07:12:53Z","title":"Agent-Sentry: Bounding LLM Agents via Execution Provenance","version":2},"cited_work":{"arxiv_id":"2603.22868","doi":null,"metadata_source":"pith","pith_arxiv_id":"2603.22868","snapshot_observed_at":"2026-07-11T02:47:49.937541Z","title":"Agent-Sentry: Bounding LLM Agents via Execution Provenance","venue":"cs.CR","work_id":"b6963609-7174-499d-a77b-12a1c0852da1","year":2026},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2603.22868","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:a26de14b23a9ad936e718030392c4ed0dfd921dc61a31c3e6321e768f231a70f","observation_id":"f8fe62a6-3db1-4c0a-8e13-a04409c7b331","resolution":{"observed_at":"2026-07-10T08:16:58.850974Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:59.494951Z","title":"2025 , eprint =","venue":null,"work_id":"10204f9e-2e4d-42b9-b778-55c3b0e441a7","year":2025},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:6f4ff4a840fb2a838ac9e2b90231d362be3f4f14a952c64f1c38e75c75ce03dd","observation_id":"5d978f9b-f689-4b46-a6a1-fdea60cde3ec","resolution":{"observed_at":"2026-07-10T08:16:59.496045Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:59.496558Z","title":"Securing","venue":null,"work_id":"acb5760d-8308-467a-aed9-b6823436588e","year":2025},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:a9bcbc0dbe87238a3e828c8d25c1c11966b887b661316870cdbf76ef65a27ab2","observation_id":"a68bfef1-a9c3-4a9d-80d8-9d1d672d2a71","resolution":{"observed_at":"2026-07-10T08:16:59.497650Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:59.498511Z","title":"2026 , url =","venue":null,"work_id":"f1db1a7d-50e8-4893-8188-01a5018856b0","year":2026},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:95ffbe211d4a8d381ff8a4c67f98dafd37f6b3c3ca8cd88fdd492b731d10bca6","observation_id":"36d2a7a9-9240-4569-8644-3f7827787bcd","resolution":{"observed_at":"2026-07-10T08:16:59.499643Z","resolver_source":"raw_fallback","status":"parse_uncertain"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.11853","doi":"10.48550/arxiv.2603.11853","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Openclaw prism: A zero-fork, defense-in-depth runtime security layer for tool-augmented llm agents","venue":"arXiv (Cornell University)","work_id":"b8740966-74b2-4fc6-ba7b-e6157af237ea","year":2026},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":42,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:b0ce764c360497b0983141115ca759dc8430a91cfc1d07aa3f4d38eeb57408db","observation_id":"5e208f93-a8b6-4633-915d-964d1741657b","resolution":{"observed_at":"2026-07-10T08:16:58.853798Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.24657","last_updated":"2026-04-27T16:22:27Z","snapshot_observed_at":"2026-08-14T01:53:53.129697Z","submitted_at":"2026-04-27T16:22:27Z","title":"AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents","version":1},"cited_work":{"arxiv_id":"2604.24657","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.24657","snapshot_observed_at":"2026-07-10T08:16:58.855185Z","title":"AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents","venue":"cs.CR","work_id":"95bc828d-ef4a-4d4f-9a73-813460ca39e3","year":2026},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"cited_paper":"/paper/2604.24657","citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:0b0b52c9ce190434f81b25e5ee72e96f7856b32efef6c055d598cc177a17f96b","observation_id":"1912f538-b7c3-4d29-87d0-a343f6b956a6","resolution":{"observed_at":"2026-07-10T08:16:58.856614Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T02:37:54.519855Z","title":null,"venue":null,"work_id":"72647878-5eae-4741-b770-5602b7561189","year":2026},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":44,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:ccc602c61bd535b209893c40bc437fa2ecee2db264ab4b74abd19a0a27df9418","observation_id":"fe7a1014-63d5-4f3a-8fc0-a428add4bdc7","resolution":{"observed_at":"2026-07-10T08:16:59.503026Z","resolver_source":"raw_fallback","status":"parse_uncertain"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:59.464424Z","title":null,"venue":null,"work_id":"42aa5dd1-7a45-4e2d-95f5-31022f5a40df","year":null},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":45,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:71c04f70db47609537b3bd7be37db2a7036f9bc49a0c1ed5d81fb6379753dc70","observation_id":"ca113b24-abee-4027-a1cb-241960562188","resolution":{"observed_at":"2026-07-10T08:16:59.466062Z","resolver_source":"raw_fallback","status":"parse_uncertain"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T08:16:59.466677Z","title":"2026 , url =","venue":null,"work_id":"f20fbc80-c753-4d95-8803-7a8f848f1f00","year":2026},"citing_paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","version":1},"reference_index":46,"source":"arxiv_source","source_observed_at":"2026-07-10T08:08:21.077290Z"},"links":{"citing_paper":"/paper/2607.08395"},"observation_digest":"sha256:961f3f43474ab8bfe3e98586d04e2cdaac3da0acb6d022f03a5aa98c83c40902","observation_id":"a20ddd14-8d3e-40ee-89cd-4c7d240b8fbc","resolution":{"observed_at":"2026-07-10T08:16:59.468126Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2607.08395","last_updated":"2026-07-09T12:18:40Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-12T23:18:29.773153Z","submitted_at":"2026-07-09T12:18:40Z","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents"},"reference_resolution":{"displayed":46,"state_counts":{"malformed_identifier":0,"metadata_mismatch":17,"parse_uncertain":3,"unresolved":2,"verified_exact":8,"verified_fuzzy":16},"total_outbound_references":46},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"thesis":"As of 20 August 2026, this Paper Citation Record lists 46 of 46 outbound references and 0 inbound Pith citation observations for arXiv:2607.08395."}