{"as_of":"2026-08-09T12:46:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:a9bc9017cfb80f657a69318cf2165a332ea6adfa8d1c7be86a77d5bf7aa920e3","coverage":[{"denominator":65,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":65,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-01T16:32:04.109230Z","state":"measured"},{"denominator":65,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":65,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.17986/citation-record","integrity":"/paper/2607.17986/integrity","json":"/paper/2607.17986/citation-record.json","paper":"/paper/2607.17986"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:00.895313Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:00.895313Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:8a85dd2919537349556415dba1cdfc2fa153dd4e691a6edba3fa8840a7cadf46","observation_id":"e6cb5c50-b16b-48b8-89af-951a10dd4b8b","resolution":{"observed_at":"2026-08-01T16:32:00.895313Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:00.988558Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:00.988558Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:119fe4277c8cb1c01b795ffb01280c83d61048a95ef674dc971755e2075ba994","observation_id":"8d3b262c-d70b-4919-a326-b2a020d98a07","resolution":{"observed_at":"2026-08-01T16:32:00.988558Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:01.114694Z","title":"Zico Kolter, Matt Fredrikson, Yarin Gal, and Xander Davies","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:01.114694Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:07e0791f48195309e2e56eca51902678e5e862bb9f3805b8ed54e5e44851a2b6","observation_id":"79b82e57-77e5-4fb6-9909-896e996552b5","resolution":{"observed_at":"2026-08-01T16:32:01.114694Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:01.248422Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:01.248422Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:c1b56f44658b80376b19258b783044614582a5ec86f7821129a637efa753ea80","observation_id":"07fbdf09-068c-4f2a-8fed-ee335eec3a2f","resolution":{"observed_at":"2026-08-01T16:32:01.248422Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:01.315741Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:01.315741Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:f6da10c18f31a901665b2089797275afeb011cec4ec7a97960704f86a373d49d","observation_id":"a9977033-c27f-48fb-a3da-edf6af70b633","resolution":{"observed_at":"2026-08-01T16:32:01.315741Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:01.443980Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:01.443980Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:e0658456e950704e41aac0ad8fc54b17c7970ea840cbc8c03a675b22fe55522c","observation_id":"e41ca7da-95ce-415d-92a7-840dec5b3bd4","resolution":{"observed_at":"2026-08-01T16:32:01.443980Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:01.697841Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:01.697841Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:e6febbf1459aed2916e09e133c55c269fe1f1a43394777e0a3085677cc082e93","observation_id":"f3a5826f-1351-468d-8ad2-dbb91a2a0111","resolution":{"observed_at":"2026-08-01T16:32:01.697841Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:01.800808Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:01.800808Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:4f4d425726b9535c5f4888e44f7d62ad0f0b4217e7d5d3a5bc7f8755064bd1f1","observation_id":"170fc142-503e-4225-a15a-44423eeb8732","resolution":{"observed_at":"2026-08-01T16:32:01.800808Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.23643","last_updated":"2025-09-03T12:30:47Z","snapshot_observed_at":"2026-07-06T21:33:02.686798Z","submitted_at":"2025-05-29T16:50:41Z","title":"Securing AI Agents with Information-Flow Control","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.23643","snapshot_observed_at":"2026-08-01T16:32:01.882739Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:01.882739Z"},"links":{"cited_paper":"/paper/2505.23643","citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:12d3ab6904f246e19993f53bb8def969a71118443c097f26b8ef0cde9d7d3296","observation_id":"94cef1f1-455c-4609-90da-73402f917a60","resolution":{"observed_at":"2026-08-01T16:32:01.882739Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-07T19:59:01.081751Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-01T16:32:02.078051Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:02.078051Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:b74ab682f03e30936340003a181706199157d58c885441d4b6cc5a4c6a820ba0","observation_id":"0cff2b97-5378-452d-98d4-f0742d2f2740","resolution":{"observed_at":"2026-08-01T16:32:02.078051Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:02.248553Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:02.248553Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:c83db5f011148a7532d766451aaba452948335ace9e2818b6ca08e554105f01d","observation_id":"4ef197fb-c10c-46ea-a1fa-5104f85e01da","resolution":{"observed_at":"2026-08-01T16:32:02.248553Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:02.370507Z","title":null,"venue":null,"work_id":null,"year":1987},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:02.370507Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:63fa6c920d29c84bf53a4deb8615e720710548f64394c1cee1ed5640c7401129","observation_id":"07db1806-b3d9-49f8-9d33-0675cd9f245b","resolution":{"observed_at":"2026-08-01T16:32:02.370507Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:02.513490Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:02.513490Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:5c9edec03ca82e976a227020909412eb6266cb3af9c9efab7c11aa4a4be18251","observation_id":"3087842c-485d-49bb-9417-0d8ec81e78c1","resolution":{"observed_at":"2026-08-01T16:32:02.513490Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.18575","last_updated":"2025-05-16T22:42:29Z","snapshot_observed_at":"2026-08-07T07:40:41.686734Z","submitted_at":"2025-04-22T17:51:03Z","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.18575","snapshot_observed_at":"2026-08-01T16:32:02.658543Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:02.658543Z"},"links":{"cited_paper":"/paper/2504.18575","citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:8d672267519cbf38b96382ec58b934a63dd2d2848b6e2f6867a0d92f852d5d6e","observation_id":"eac6395b-4992-42d6-a756-9675dbc7db1b","resolution":{"observed_at":"2026-08-01T16:32:02.658543Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:02.814537Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:02.814537Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:12db81621bb0da375059cca5e667a074ad605036a8f4f9e0079401136d1912d1","observation_id":"7c227af0-a04d-4707-97c5-a99dee77d92c","resolution":{"observed_at":"2026-08-01T16:32:02.814537Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:02.962794Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:02.962794Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:58e6a547a06feb38225ee95d045714d492d9fe692f0a8064b00e86e4e7b7f6b4","observation_id":"f9cf887b-5c83-4c51-bf42-f71a913a3242","resolution":{"observed_at":"2026-08-01T16:32:02.962794Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.025067Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.025067Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:84a1b5ecfeebd63eb13dc2ad35a2e1bba64e8f28bea053e58bf8467e392348db","observation_id":"3f41fadb-580d-47b8-a71d-064ee5fde3e7","resolution":{"observed_at":"2026-08-01T16:32:03.025067Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.069797Z","title":null,"venue":null,"work_id":null,"year":1988},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.069797Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:4372229e9dafd0a02c6f2f5da90e68453cd1da76dee4275cb23c0c08516e4daf","observation_id":"42a33a3b-5462-4648-9cc7-d2cdcfe441ef","resolution":{"observed_at":"2026-08-01T16:32:03.069797Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.135588Z","title":"Javitz and Alfonso Valdes","venue":null,"work_id":null,"year":1994},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.135588Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:08022b80eea81b7b85d42d989de2d9183f66a9a13beb9efffb75641164df2bdc","observation_id":"11ef57d7-992e-4929-8f52-6e5cb070f000","resolution":{"observed_at":"2026-08-01T16:32:03.135588Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.216025Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.216025Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:00a476a9db5186c0b48acd3defa6d0fa1b7035a600f8683e5f365992cb396f00","observation_id":"4c07f36d-495b-4cb3-84fe-e66424a298b9","resolution":{"observed_at":"2026-08-01T16:32:03.216025Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.328133Z","title":"Kim and Eugene H","venue":null,"work_id":null,"year":1994},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.328133Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:b5ca22ec370b69233d8bc0299dfe68a17e1d9b9bf8aebf5de1680e54d6b926b4","observation_id":"ce80b241-d862-4c60-8727-d2daa4811b69","resolution":{"observed_at":"2026-08-01T16:32:03.328133Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.15547","last_updated":"2025-04-21T02:10:14Z","snapshot_observed_at":"2026-08-07T16:58:59.881146Z","submitted_at":"2025-03-17T05:27:57Z","title":"Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.15547","snapshot_observed_at":"2026-08-01T16:32:03.401887Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.401887Z"},"links":{"cited_paper":"/paper/2503.15547","citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:14d6104c42279bcd08ce92a8fed18ec2ae533982cfe5d04761f57ec8c97e1dd5","observation_id":"f9cc4d59-1e71-4829-a438-769a55b1fa57","resolution":{"observed_at":"2026-08-01T16:32:03.401887Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.474217Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.474217Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:ff094b566a36d85a519fdf35b15c49f22186bd0438d315a60efa26955bbbd575","observation_id":"c4d07ab2-852a-4669-b11e-a22fc15e1bca","resolution":{"observed_at":"2026-08-01T16:32:03.474217Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.580099Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.580099Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:55c5c40c3a862c265a81641bdec90391989d1d27e76f0c4651ddf2153a30677c","observation_id":"ef741cd4-e4e7-4e26-bfe3-bbead7d97f8c","resolution":{"observed_at":"2026-08-01T16:32:03.580099Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.643447Z","title":null,"venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.643447Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:fe8000a19a84330b870d3095be69aad78439a5ca341bbdd4e50d8954068a0235","observation_id":"eeda7952-86c6-4e1e-b161-1dc868c6658a","resolution":{"observed_at":"2026-08-01T16:32:03.643447Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.759055Z","title":null,"venue":null,"work_id":null,"year":2008},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.759055Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:ca4b1524d2e6f5514d5646289038c3151bac1bdedc0f626f96f909dde57137f3","observation_id":"33e29120-e667-457e-a100-a7586ad359d1","resolution":{"observed_at":"2026-08-01T16:32:03.759055Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2010.03759","last_updated":"2021-04-26T04:59:58Z","snapshot_observed_at":"2026-07-06T10:02:30.383493Z","submitted_at":"2020-10-08T04:42:17Z","title":"Energy-based Out-of-distribution Detection","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2010.03759","snapshot_observed_at":"2026-08-01T16:32:03.814842Z","title":"Owens, and Yixuan Li","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.814842Z"},"links":{"cited_paper":"/paper/2010.03759","citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:d39ee54b0edd29e5152f39dcfd8c7751a7eb4f48e47e2e8d74d8fdcf3458c5f7","observation_id":"9c4489b4-0c38-438b-98a1-fea93a6b2033","resolution":{"observed_at":"2026-08-01T16:32:03.814842Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.872294Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.872294Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:59321ddde3ca83e93cc0675215144171ff5d59b747bd2d278dc1366c73e9fad5","observation_id":"84362197-6ec5-4b1c-8b97-8647038d8646","resolution":{"observed_at":"2026-08-01T16:32:03.872294Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2509.22040","last_updated":"2026-04-28T01:43:32Z","snapshot_observed_at":"2026-08-02T08:19:00.747753Z","submitted_at":"2025-09-26T08:20:54Z","title":"\"Your AI, My Shell\": Demystifying Prompt Injection Attacks on Agentic AI Coding Editors","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2509.22040","snapshot_observed_at":"2026-08-01T16:32:03.926994Z","title":"Your AI, My Shell","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.926994Z"},"links":{"cited_paper":"/paper/2509.22040","citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:732316d929540485b068bdeb9abdc115d9f803bc049f56333a6be5076a766bfe","observation_id":"504ff778-9074-4a99-ad76-44c4719cc3a9","resolution":{"observed_at":"2026-08-01T16:32:03.926994Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.966039Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.966039Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:6d5f0cf58e54b3879db7db49f6733a849dca07d21e08bf72ac183cc74752905f","observation_id":"d45ca0a3-46da-4a0a-99df-65168967fc8a","resolution":{"observed_at":"2026-08-01T16:32:03.966039Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.970855Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.970855Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:7a20eff0cf5cb57fdb0f1b4fd323af4c3245ff8aca0c15bd4c1e4501d691d6f4","observation_id":"72171527-a74d-470e-a86b-f83c182538cc","resolution":{"observed_at":"2026-08-01T16:32:03.970855Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.974957Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.974957Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:f76a7aef245a1f81382c74a21025e51acc8b86476796d87170932316994cdd8c","observation_id":"8bc565a2-66cf-48b2-bb71-2957d3451cc5","resolution":{"observed_at":"2026-08-01T16:32:03.974957Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.978754Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.978754Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:6f1a2d2b06505e864f48d1e80d06f9bd5c63bc6f209ba0ec703c4e7fae5171bb","observation_id":"df6bc5ae-90ae-4974-896c-120b224815f2","resolution":{"observed_at":"2026-08-01T16:32:03.978754Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.983414Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.983414Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:c1139da1c6a687604092134db6e0895dbb3ed63072a7e618fab7dbc5140eda31","observation_id":"f67e1078-752e-4b09-b63b-0af1321e791e","resolution":{"observed_at":"2026-08-01T16:32:03.983414Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.987233Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.987233Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:2cfcd9b35cba96174b0aef8452f264df04440517233b0352ecb3d5eab4932c4f","observation_id":"bbe0a307-98b0-4759-8000-43f5aa999ad2","resolution":{"observed_at":"2026-08-01T16:32:03.987233Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.991255Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.991255Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:509054010687b777faacfc351781d3f73ee7dcfe30ead8d70d555e25ab6bf4a8","observation_id":"dadfb904-6857-4d75-b7ec-ab1d04680191","resolution":{"observed_at":"2026-08-01T16:32:03.991255Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.995312Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.995312Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:5dd8e3675179e5427aff95aafae0a7c093a311e938b35cde3c085a454731f0aa","observation_id":"e7d30231-86b5-4e31-862e-c375e6a4a27e","resolution":{"observed_at":"2026-08-01T16:32:03.995312Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:03.999121Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.999121Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:4f937f37ef128f29ffe48ff03ca5c672b324704dcf096ea225a0e2ab5ebca760","observation_id":"7e6795c0-ff15-4a31-8e72-2df749f14b48","resolution":{"observed_at":"2026-08-01T16:32:03.999121Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.003955Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.003955Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:f717ed0b5885d8502fb412686145ce2702ee520a3cb5e4bcab1ac96be0787a41","observation_id":"834deaaa-d717-4728-8189-cbb077a9367f","resolution":{"observed_at":"2026-08-01T16:32:04.003955Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.04870","last_updated":"2024-10-23T05:55:31Z","snapshot_observed_at":"2026-07-06T18:58:43.349175Z","submitted_at":"2024-08-09T05:20:05Z","title":"ConfusedPilot: Confused Deputy Risks in RAG-based LLMs","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.04870","snapshot_observed_at":"2026-08-01T16:32:04.007867Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.007867Z"},"links":{"cited_paper":"/paper/2408.04870","citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:b72851a2fba5cdc63e6d61879dd3f76c58bc7770cb3001709f4204e7a956ecdd","observation_id":"3bfbfcb4-d053-4cc4-b692-0a084af6cbf8","resolution":{"observed_at":"2026-08-01T16:32:04.007867Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.012434Z","title":"Maddison, and Tatsunori Hashimoto","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.012434Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:d7141bba00ad693c2c2fd91f4b9db1622dabedef378a844898f3f2cb3f78b4d8","observation_id":"d43e54c0-7501-488c-b6c3-6d131dc7fef5","resolution":{"observed_at":"2026-08-01T16:32:04.012434Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.016780Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.016780Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:b8f08b7332a081deec14063d5b8c3ba43416e9b62b4db4aa618c39cdc03330e5","observation_id":"3bcb4dd8-e766-4dc6-89ab-2d2526b97212","resolution":{"observed_at":"2026-08-01T16:32:04.016780Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.11703","last_updated":"2026-05-14T02:36:38Z","snapshot_observed_at":"2026-07-06T21:10:09.129714Z","submitted_at":"2025-04-16T01:58:40Z","title":"Progent: Securing AI Agents with Privilege Control","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.11703","snapshot_observed_at":"2026-08-01T16:32:04.020948Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.020948Z"},"links":{"cited_paper":"/paper/2504.11703","citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:7ce46477f7cc19b0a4e22f12b487ab8bc50207bb20287cced987b3c4ae2c9fce","observation_id":"0724d02b-4a0e-4f27-802d-639dc67c165f","resolution":{"observed_at":"2026-08-01T16:32:04.020948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.025591Z","title":"Stolfo, Shlomo Hershkop, Linh H","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.025591Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:69ef5d85e2f1f04afc0fe1331b0e09549134c63b13205198b669b06a0fbe236b","observation_id":"f0af26f2-939a-49d0-8250-6796fb0ae11d","resolution":{"observed_at":"2026-08-01T16:32:04.025591Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.034319Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.034319Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:c698b868a9f9309acbc7ca0f179872c0f483f23b58206c40afbe0c8e42e7ab4a","observation_id":"c4d01513-b9a9-463c-860c-cfa886c8d5b0","resolution":{"observed_at":"2026-08-01T16:32:04.034319Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.038720Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.038720Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:6fb098f4c73eb7c1c936bad8e0a341665151a92236db0036b04dc10cfd7861c6","observation_id":"a3fb36d5-9d0d-4be9-8359-e1b15da9d9f9","resolution":{"observed_at":"2026-08-01T16:32:04.038720Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18666","last_updated":"2025-07-31T04:00:48Z","snapshot_observed_at":"2026-07-06T20:57:47.748881Z","submitted_at":"2025-03-24T13:31:48Z","title":"AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18666","snapshot_observed_at":"2026-08-01T16:32:04.042533Z","title":"Poskitt, and Jun Sun","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.042533Z"},"links":{"cited_paper":"/paper/2503.18666","citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:d39808a4ba121e218879700106bf79c3261d4c9c75b27c447ab1e4e1f4d322ed","observation_id":"20b17c00-8ad4-4381-bd20-3ac465f49f0b","resolution":{"observed_at":"2026-08-01T16:32:04.042533Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.047191Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.047191Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:b4669d933f511012425e5b7773677ac74a63023d6552fbce34c79139e75084e1","observation_id":"855df053-69cd-4a8b-b7fa-13c1afb56d2e","resolution":{"observed_at":"2026-08-01T16:32:04.047191Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.052582Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.052582Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:3d8dba65f44a97b631f55b7a02191b29b45b8e05fc435c030a53c8bb2f97296f","observation_id":"45414c67-e08b-4a68-bdaa-2b1d39fce2bb","resolution":{"observed_at":"2026-08-01T16:32:04.052582Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.056710Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.056710Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:601f86708dcbd143dedec78389866eda3983f8eb73175d6d44a1baeeb0519700","observation_id":"3651d0ce-b779-4e99-b789-80f79302127f","resolution":{"observed_at":"2026-08-01T16:32:04.056710Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.09187","last_updated":"2025-05-29T03:09:05Z","snapshot_observed_at":"2026-07-06T18:30:23.849880Z","submitted_at":"2024-06-13T14:49:26Z","title":"GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.09187","snapshot_observed_at":"2026-08-01T16:32:04.064947Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.064947Z"},"links":{"cited_paper":"/paper/2406.09187","citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:6fa8c64386d9f4f6b45f97cea909a2581ce4fe697cc2ee0ba1d7a8e530dbc9aa","observation_id":"913dc9ff-7860-4fa5-a1dc-bc602e374295","resolution":{"observed_at":"2026-08-01T16:32:04.064947Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.069242Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.069242Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:1bea5fa712cd29dcc043a20abfe8b50c8fcc0574790dd49303e5f44def5c22fc","observation_id":"f1adf533-abe5-410d-8663-ce4b2ffeff68","resolution":{"observed_at":"2026-08-01T16:32:04.069242Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.073271Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.073271Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:dd9df7dee0e0eec4165c99a6ac4aed6f6a7fb88be9995c0335d7c9f9a042826f","observation_id":"4dff244c-1af9-4973-a8a9-0ae4acff1d7a","resolution":{"observed_at":"2026-08-01T16:32:04.073271Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.077412Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.077412Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:87f8867ab9ff0e2502d2aa04cc610c714a89619d9364715675c576b68dd4379f","observation_id":"a6820855-f402-40c3-82a3-64f974243bd4","resolution":{"observed_at":"2026-08-01T16:32:04.077412Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.081341Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.081341Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:7892833e71cd5e8fd9eaab53fda565b9076321042ce720d7ff645b30ca59c62d","observation_id":"f9f687c4-3adb-4114-a437-3113bdb75a5e","resolution":{"observed_at":"2026-08-01T16:32:04.081341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.089378Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.089378Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:7443dab25ea6d37801f2b5729127cfdc92ad8df4800703f405dcd71b5a03c604","observation_id":"83aa7598-ad8d-47c4-ae1c-bafa577cb77b","resolution":{"observed_at":"2026-08-01T16:32:04.089378Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.02644","last_updated":"2025-05-30T03:50:33Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-10-03T16:30:47Z","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.02644","snapshot_observed_at":"2026-08-01T16:32:04.097021Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.097021Z"},"links":{"cited_paper":"/paper/2410.02644","citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:8c1771c1eab09c84c13ac5383bf951dea62f36f78932b88e65f0d0c41567bc92","observation_id":"aaf8b5b4-0d15-4981-a825-f1342f6301ed","resolution":{"observed_at":"2026-08-01T16:32:04.097021Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.101212Z","title":"Xing, Hao Zhang, Joseph E","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.101212Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:c7f70bbb3f6338a24de75573a59ea947d21fa2c412db2f9547b2781c31752769","observation_id":"c691f9a4-281f-47c1-9f44-290f1cdc0967","resolution":{"observed_at":"2026-08-01T16:32:04.101212Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.105418Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.105418Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:1668056a67b4eb81a8eaca2af76cfb22bea395bd4548a3cdd03abb185a2d1a9c","observation_id":"87155e9c-fc70-4b35-92b3-e220c1eaad19","resolution":{"observed_at":"2026-08-01T16:32:04.105418Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.109230Z","title":"set channels.telegram.enabledto false","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.109230Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:8b94529acd56396cc563d5fcadbd7c21ed2d4453abda5efd525f53f18d11ebb9","observation_id":"e5d82d27-342f-4d41-99b8-e5dbfc859cf8","resolution":{"observed_at":"2026-08-01T16:32:04.109230Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1007/1142","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"InInternational Symposium on Methodologies for Intelligent Sys- tems (ISMIS) (Lecture Notes in Computer Science 3488)","venue":"Chemistry of Heterocyclic Compounds","work_id":"f7e2974b-aec2-4e01-b05e-7872ac45f6be","year":null},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":2005,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.030055Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:bb5cc3d3a00dcedf9c01d03650b3ee7ec7ae0f15e6df561b3b0d2e66ed074912","observation_id":"092b5d1f-237d-4ba6-99d0-8dc79be90781","resolution":{"observed_at":"2026-08-01T16:33:29.305516Z","resolver_source":"doi_truncated","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.093178Z","title":"doi:10.18653/v1/2024.findings-acl.624","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.093178Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:bc42d5fb523b4e4b852a10cf6feeb607638248d9396182619c2a344792be7716","observation_id":"4a8237bd-8735-4b0c-b457-151ac0713918","resolution":{"observed_at":"2026-08-01T16:32:04.093178Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.04960","last_updated":"2025-01-30T22:55:18Z","snapshot_observed_at":"2026-08-06T11:42:59.851078Z","submitted_at":"2024-03-08T00:02:30Z","title":"IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.04960","snapshot_observed_at":"2026-08-01T16:32:04.060879Z","title":"InProceedings of the Network and Distributed System Security Sympo- sium","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":2025,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.060879Z"},"links":{"cited_paper":"/paper/2403.04960","citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:06e9f1dd648a086930d534d4b3d29ce65e028465bc2542946fff0247b2a1aa76","observation_id":"0ec8be4d-ff86-4468-8d02-f2d0c6e8eee1","resolution":{"observed_at":"2026-08-01T16:32:04.060879Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:32:04.085433Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":7132,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:04.085433Z"},"links":{"citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:f9d3dd99bdf38cf9f3f4a98cdce8f7ead49b107e176408cd06297931713d78c1","observation_id":"e017a67b-e86d-4292-b60f-5893b76d9516","resolution":{"observed_at":"2026-08-01T16:32:04.085433Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1807.03888","last_updated":"2018-10-27T08:47:18Z","snapshot_observed_at":"2026-08-07T05:22:59.468998Z","submitted_at":"2018-07-10T22:14:04Z","title":"A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1807.03888","snapshot_observed_at":"2026-08-01T16:32:03.702310Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","version":1},"reference_index":7177,"source":"pdf_text","source_observed_at":"2026-08-01T16:32:03.702310Z"},"links":{"cited_paper":"/paper/1807.03888","citing_paper":"/paper/2607.17986"},"observation_digest":"sha256:4b6fc9564f35871513f359bc2ae16dd5705f17c617046d9dcf5657b4d00e09c3","observation_id":"a964b6a1-09d3-43d0-980f-19510e3b45cf","resolution":{"observed_at":"2026-08-01T16:32:03.702310Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.17986","last_updated":"2026-07-20T14:16:55Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-05T13:59:48.633736Z","submitted_at":"2026-07-20T14:16:55Z","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?"},"reference_resolution":{"displayed":65,"state_counts":{"malformed_identifier":2,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":63,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":65},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 65 of 65 outbound references and 0 inbound Pith citation observations for arXiv:2607.17986."}