{"as_of":"2026-08-14T08:47:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:47faa90b81df1da80b0cffcd52478cbb82fea96ca1c33b3deac07f1c8a734fd0","coverage":[{"denominator":23,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":23,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-01T15:07:27.137476Z","state":"measured"},{"denominator":23,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":23,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-14T06:32:32.682623+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.19432/citation-record","integrity":"/paper/2607.19432/integrity","json":"/paper/2607.19432/citation-record.json","paper":"/paper/2607.19432"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:25.078957Z","title":"Introducing the Model Context Protocol,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.078957Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:b5b8a7c4ff167b248f4f288de9c9b34392e4a876e9e232e7b1be27c84c3ecdcb","observation_id":"297ecb51-a18b-4f54-92bf-ea852bf64b3f","resolution":{"observed_at":"2026-08-01T15:07:25.078957Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.23278","last_updated":"2025-10-07T07:13:32Z","snapshot_observed_at":"2026-08-14T03:34:08.418318Z","submitted_at":"2025-03-30T01:58:22Z","title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.23278","snapshot_observed_at":"2026-08-01T15:07:25.375608Z","title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.375608Z"},"links":{"cited_paper":"/paper/2503.23278","citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:d901e7756c8249e81b81d7e77f401967b5650ce3e9c3703f4e94a62f659839dc","observation_id":"7fcd43c2-53aa-4586-b12f-09ea20480fdb","resolution":{"observed_at":"2026-08-01T15:07:25.375608Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:25.544016Z","title":"MCP Security Notification: Tool Poison- ing Attacks and GitHub MCP Prompt Injection,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.544016Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:714e08db012f2043f5bf19d3daf8b4a5d9d0c5bdc875b779177f13f34686bd97","observation_id":"04849e86-e6cb-4d28-b1be-e6afc5c30c46","resolution":{"observed_at":"2026-08-01T15:07:25.544016Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:25.602557Z","title":"WhatsApp MCP Exploited via Rug-Pull At- tack,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.602557Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:0ec6696a7e975b2276c5f4826ba7cb4c416ff4b3a487d51607b378b90d79156f","observation_id":"cf71caf9-db01-46bd-968c-f1304c3ddaaa","resolution":{"observed_at":"2026-08-01T15:07:25.602557Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2509.25624","last_updated":"2026-07-19T03:06:33Z","snapshot_observed_at":"2026-08-14T04:38:18.838394Z","submitted_at":"2025-09-30T00:31:44Z","title":"STAC: When Innocent Tools Form Dangerous Chains for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2509.25624","snapshot_observed_at":"2026-08-01T15:07:25.693636Z","title":"STAC: When Innocent Tools Form Dangerous Chains to Jailbreak LLM Agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.693636Z"},"links":{"cited_paper":"/paper/2509.25624","citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:041e557760daf0593c504a9c493125c81d79f8418815f4e8dd870676bb9dab60","observation_id":"0881bdf9-edf7-46d9-bf0c-d7d0962ec40f","resolution":{"observed_at":"2026-08-01T15:07:25.693636Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:25.774651Z","title":"The Promptware Kill Chain,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.774651Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:accff8773afaf065ad2f324cd75b34956d87676cf9fdd0069a2609f721aa94ee","observation_id":"65f1943e-24c4-473c-9887-ab358dc24999","resolution":{"observed_at":"2026-08-01T15:07:25.774651Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:25.951008Z","title":"MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.951008Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:c87c850245f15d61d940673d67fb99e3e4dd2c85dc0f2f798d0381ac23be3006","observation_id":"6b5ead94-6e06-456a-a533-e26dd79ef1c2","resolution":{"observed_at":"2026-08-01T15:07:25.951008Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.076931Z","title":"MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AI,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.076931Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:fb13d731d73b1c767e8ddc88332dad7b7c2d8ff4a0a9e1e78c9a4970f289e38b","observation_id":"f1ba299a-d8ca-40a0-93da-835264868d79","resolution":{"observed_at":"2026-08-01T15:07:26.076931Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.138141Z","title":"MindGuard: Tracking, Detecting, and Attributing MCP Tool Poisoning Attack via Decision Dependence Graph,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.138141Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:a65563fdba2160f9fe66ebd55255de1acd05edf23ed7cfae61ded86e327ce4f4","observation_id":"00143c95-048a-4af2-a9b5-3d83aadadea0","resolution":{"observed_at":"2026-08-01T15:07:26.138141Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.188371Z","title":"MCPTox: A Benchmark for Tool Poisoning on Real-World MCP Servers,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.188371Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:813628593647e4d12725310c82e6d4a4011eaa5254a205996b0e94818ace0712","observation_id":"5d1b7a0b-8918-4914-97de-e8df3ed51067","resolution":{"observed_at":"2026-08-01T15:07:26.188371Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-08-01T15:07:26.264517Z","title":"Beyond the Protocol: Empirical Analysis of MCP Attack Scenarios,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.264517Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:000b23d029093dad8533f80a693223b3341dc0c374fc75d3f54a4996cc86a64e","observation_id":"ac9760dd-fcee-4ada-9c1f-9d509e6b9ad9","resolution":{"observed_at":"2026-08-01T15:07:26.264517Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.325748Z","title":"A systematic survey on multi- step attack detection,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.325748Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:99ae4d384afc59e11b9c4da059f8fd2585f92304ceeaf71478f4023ca077e140","observation_id":"5160222a-3cc9-4d01-9c55-94a5df232b4b","resolution":{"observed_at":"2026-08-01T15:07:26.325748Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.441209Z","title":"Real-time multistep attack prediction based on hidden Markov models,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.441209Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:6fd7e857d28cddd893baaaa251ac938e231238405f0371a446c623eb859bd678","observation_id":"773bc88e-6868-40d6-8314-ee3e5b2081b4","resolution":{"observed_at":"2026-08-01T15:07:26.441209Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.534645Z","title":"KAIROS: Practical Intrusion Detection and Investigation using Whole- system Provenance,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.534645Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:f5d333ab83c8e947f89773a0a2f4e92f51e1e4fd142369dd6b0f87e0180da110","observation_id":"a689a81e-7bc8-4f53-a1c5-e2e4fb0545ef","resolution":{"observed_at":"2026-08-01T15:07:26.534645Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.594388Z","title":"MAAC: Multi-step Attack Alert Correlation using Semantic Vectorization,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.594388Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:0e8e83a4272a37f1a73406d0a481e3ec04c1a690354f4c180121d3c91b214a22","observation_id":"3205e2af-fccb-4420-b4f0-10af8a31d27b","resolution":{"observed_at":"2026-08-01T15:07:26.594388Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.03767","last_updated":"2025-04-11T16:59:05Z","snapshot_observed_at":"2026-08-12T07:07:45.143945Z","submitted_at":"2025-04-02T21:46:02Z","title":"MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.03767","snapshot_observed_at":"2026-08-01T15:07:26.667184Z","title":"MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Vulnerabilities,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.667184Z"},"links":{"cited_paper":"/paper/2504.03767","citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:ca3b584e639766eec8e74b5a62e68bc3f321f7bb3268af0254b35d797443aef9","observation_id":"419dc962-5f29-4880-9bb4-9ac28e2d0310","resolution":{"observed_at":"2026-08-01T15:07:26.667184Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.724243Z","title":"MCP-SafetyBench: A Benchmark for Safety Evaluation of Large Language Models with Real- World MCP Servers,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.724243Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:b68fda9ce5aec214531950189c5f4befe8cdb1e103ba8dda1197d5b54cf88313","observation_id":"f8e68bd0-9940-4d46-a07c-075d574fcc25","resolution":{"observed_at":"2026-08-01T15:07:26.724243Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.08623","last_updated":"2025-05-02T18:26:39Z","snapshot_observed_at":"2026-08-07T16:06:28.979271Z","submitted_at":"2025-04-11T15:25:58Z","title":"Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategies","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.08623","snapshot_observed_at":"2026-08-01T15:07:26.820487Z","title":"Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategies,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.820487Z"},"links":{"cited_paper":"/paper/2504.08623","citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:cdf066523f605588ddb32c60641139dc22d0a4860bcd40dbf5e30c38bf25ada2","observation_id":"bba5fd3a-39c3-46de-b413-da05b33b197e","resolution":{"observed_at":"2026-08-01T15:07:26.820487Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.947983Z","title":"Temporal Attack Pattern Detection in Multi-Agent AI Workflows: An Open Framework for Training Trace-Based Security Models,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.947983Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:d5416bb09f43a0268fce4b77faca3bd6115c4b9cbd532515227424955d8644af","observation_id":"81f4d9d6-bcbd-4dce-a97d-b887707ba0fe","resolution":{"observed_at":"2026-08-01T15:07:26.947983Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:27.040743Z","title":"From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:27.040743Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:f084808f31ed3ac2b67237c15966c8dab5b094de984d426870b39726206f895a","observation_id":"480047d8-bc68-41a9-a14e-5ea1cdd6f4c3","resolution":{"observed_at":"2026-08-01T15:07:27.040743Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:27.073413Z","title":"Cross-Agent Privilege Escalation: When Agents Free Each Other,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:27.073413Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:d34fdd6c5280424fa0f257746411ec70c19fe4f86d9b347fdf62ea8605be1195","observation_id":"11ef57fd-0de9-4141-a9b8-845aaf3494d7","resolution":{"observed_at":"2026-08-01T15:07:27.073413Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:27.137476Z","title":"Poison Everywhere: No Output from Your MCP Server is Safe,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:27.137476Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:406d9ab509a2bd001b761795ca45bd9c772fc15109c623c5564deedaaea14d62","observation_id":"8c0ed8bd-ff51-4e02-b3e7-88c98fe23732","resolution":{"observed_at":"2026-08-01T15:07:27.137476Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:25.234002Z","title":"Available: https://www.anthropic.com/news/ model-context-protocol","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.234002Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:4540d77e4b5ec27ba57769e2f5ee3e15be503aa18a16f069d643f235d71e86bd","observation_id":"a8fa1f76-858c-4d0a-8631-7fbab9b279bb","resolution":{"observed_at":"2026-08-01T15:07:25.234002Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-07T13:12:17.223587Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems"},"reference_resolution":{"displayed":23,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":23,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":23},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"thesis":"As of 14 August 2026, this Paper Citation Record lists 23 of 23 outbound references and 0 inbound Pith citation observations for arXiv:2607.19432."}