{"as_of":"2026-08-22T21:24:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:f054a9cdc6387a3a28e9857ada07cb669e3992319d9605fae3ff9ce7ea4366f2","coverage":[{"denominator":36,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":36,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-01T11:38:21.167591Z","state":"measured"},{"denominator":36,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":36,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-22T06:32:14.747728+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.19837/citation-record","integrity":"/paper/2607.19837/integrity","json":"/paper/2607.19837/citation-record.json","paper":"/paper/2607.19837"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:17.724576Z","title":"Toolformer: Language models can teach themselves to use tools,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:17.724576Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:86ac39719bea7ec992590a251f022eee5eb6bda0ddb49b2fe31c8afa430420d5","observation_id":"439a50fc-99b9-4e87-8b3e-ef0aa8567205","resolution":{"observed_at":"2026-08-01T11:38:17.724576Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2210.03629","last_updated":"2023-03-10T01:00:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-10-06T01:00:32Z","title":"ReAct: Synergizing Reasoning and Acting in Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2210.03629","snapshot_observed_at":"2026-08-01T11:38:17.811439Z","title":"React: Synergizing reasoning and acting in language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:17.811439Z"},"links":{"cited_paper":"/paper/2210.03629","citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:ee27cb46e8247371249a4b4dc649a66a2dcab6963863c9bdb3157b2525803f58","observation_id":"406f13a8-d145-472d-abd3-0c4fea9fd29a","resolution":{"observed_at":"2026-08-01T11:38:17.811439Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:17.873374Z","title":"Webarena: A realistic web environ- ment for building autonomous agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:17.873374Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:5472bb14e66d0eb31f67e3738e33697b46e5e4bc837578f43142b7ffe125128a","observation_id":"3835fcb9-75e7-43d8-9357-b1e3b5998c37","resolution":{"observed_at":"2026-08-01T11:38:17.873374Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:17.939940Z","title":"Hug- ginggpt: Solving ai tasks with chatgpt and its friends in hugging face,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:17.939940Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:0602cd711489e5ec209e72c5f646f8f5dcb9301fb07be54d7a08f7f5fd277f66","observation_id":"dc5d88c4-e067-4ab8-a17b-266a9a27e4f4","resolution":{"observed_at":"2026-08-01T11:38:17.939940Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:18.003418Z","title":"Openhands: An open platform for ai software developers as generalist agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:18.003418Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:a4f53725ea098b2588c25d93e8923ee30261228cde05463ca1b1d76bb3fbe456","observation_id":"4324c514-e183-449d-85ee-2f56c0bfff77","resolution":{"observed_at":"2026-08-01T11:38:18.003418Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:18.073366Z","title":"Not what you’ve signed up for: Compromising real- world llm-integrated applications with indirect prompt injection,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:18.073366Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:1fe35dbe3d64acdc6261f9f8a7e30986ae1be554ee69d47fb438a641d9a93cc2","observation_id":"ef692a33-3a5a-4d1e-8e4f-32f774fed009","resolution":{"observed_at":"2026-08-01T11:38:18.073366Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:18.157562Z","title":"OW ASP Top 10 for Large Language Model Applications,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:18.157562Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:47da5eba55332e1f71899fcb5385ecf9f636aade6620d5b386f2c342633b24f2","observation_id":"b8224f54-7a93-4d77-907b-630c8fd2f9e3","resolution":{"observed_at":"2026-08-01T11:38:18.157562Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:18.279577Z","title":"Prompt injection attacks against gpt-3,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:18.279577Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:95d67278298e785234caaaf34a88589bb95b97c258f57e3ff0ed6b1c396c6e82","observation_id":"69c3665a-794d-4bbf-a3a7-5398b763c3f3","resolution":{"observed_at":"2026-08-01T11:38:18.279577Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2211.09527","last_updated":"2022-11-17T13:43:20Z","snapshot_observed_at":"2026-08-18T00:11:55.170013Z","submitted_at":"2022-11-17T13:43:20Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2211.09527","snapshot_observed_at":"2026-08-01T11:38:18.391594Z","title":"Ignore previous prompt: Attack techniques for language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:18.391594Z"},"links":{"cited_paper":"/paper/2211.09527","citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:bc0e8eb313da8489bf7e3e011edecbd8bf5040d4864d8835ee0c8ebe87ce3e22","observation_id":"0f285f95-910b-465d-acc6-52ad24d85793","resolution":{"observed_at":"2026-08-01T11:38:18.391594Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:18.505283Z","title":"Agentvigil: Automatic black-box red-teaming for indirect prompt injection against llm agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:18.505283Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:1102a2f8f3e8a61d7ce5c9a7d516a6d5176179e2b39137f9a32e00b4c978a4be","observation_id":"1d34a9f1-220a-4668-9a11-9b2259266236","resolution":{"observed_at":"2026-08-01T11:38:18.505283Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:18.597411Z","title":"Topicattack: An indirect prompt injection attack via topic transition,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:18.597411Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:93f5bd5942bdd1ac74a04680853f525b2c32cdf7974a8e0484a4f643ce25d991","observation_id":"24eae479-604f-4232-bf5d-39ced6fdad31","resolution":{"observed_at":"2026-08-01T11:38:18.597411Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:18.703530Z","title":"Agentx- ploit: End-to-end red-teaming for ai agents powdered by multi-agent systems","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:18.703530Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:4a330289f9c7418d817a7ee75968b991c0a082edf12076ec07fd39c3924bba85","observation_id":"c1f18558-62f8-4566-9ddf-8fca0cd700df","resolution":{"observed_at":"2026-08-01T11:38:18.703530Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:18.773275Z","title":"Adaptools: Adaptive tool-based in- direct prompt injection attacks on agentic llms,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:18.773275Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:41718cfdb0ecda37013fe4140b1b09df6afd84edca67f4930e84d4563c078b3c","observation_id":"d091e421-e7d3-4936-ab85-ce9eda9ccf9b","resolution":{"observed_at":"2026-08-01T11:38:18.773275Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:18.917301Z","title":"Security challenges in ai agent deployment: Insights from a large scale public competi- tion,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:18.917301Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:bffeb735d470964d0df2bf3b1cb23eae6b066a9fe61819d6aeccb10de31ab62e","observation_id":"74d790ad-8cb5-4176-bda6-496a1c82b9f4","resolution":{"observed_at":"2026-08-01T11:38:18.917301Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:18.974397Z","title":"\"real attackers don’t compute gradients","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:18.974397Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:fa5cc77fdbee383cabf7bb57815384386be2f97126ef8252a3c500cbe6f7df22","observation_id":"16c1cd37-6130-40e8-95af-1498e1c15a93","resolution":{"observed_at":"2026-08-01T11:38:18.974397Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05499","last_updated":"2025-12-29T02:25:27Z","snapshot_observed_at":"2026-08-21T23:11:31.486806Z","submitted_at":"2023-06-08T18:43:11Z","title":"Prompt Injection attack against LLM-integrated Applications","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.05499","snapshot_observed_at":"2026-08-01T11:38:19.117826Z","title":"Prompt injection attack against llm-integrated applications,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:19.117826Z"},"links":{"cited_paper":"/paper/2306.05499","citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:c7167fb70b114a2a24097ea826126989b56702e39b0cf9c02676f939955a124f","observation_id":"509b499f-e1b6-4b29-a5c4-111513f6c1fd","resolution":{"observed_at":"2026-08-01T11:38:19.117826Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:19.156471Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:19.156471Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:bcad82547b7e5e4a4a741c10ae3680127df7a495664e8e5a86e4e6a07a11f42f","observation_id":"3d7e5468-3fd0-4549-9d6d-d937b507e4f5","resolution":{"observed_at":"2026-08-01T11:38:19.156471Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02691","last_updated":"2024-08-04T04:52:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-05T06:21:45Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.02691","snapshot_observed_at":"2026-08-01T11:38:19.254094Z","title":"Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:19.254094Z"},"links":{"cited_paper":"/paper/2403.02691","citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:58f1b710bb894e3c511c545d642035c24cabce0cd697ac8b83fa6e1dfe852c08","observation_id":"c3b1ab49-46b0-4d2e-b6ef-2942b7526974","resolution":{"observed_at":"2026-08-01T11:38:19.254094Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2509.22830","last_updated":"2026-04-13T15:36:16Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-09-26T18:38:07Z","title":"ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2509.22830","snapshot_observed_at":"2026-08-01T11:38:19.374306Z","title":"Chatinject: Abusing chat templates for prompt injection in llm agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:19.374306Z"},"links":{"cited_paper":"/paper/2509.22830","citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:bd289bf9506dca017a53b09edd0a8b134467139150df55b81fca2858f693ab3f","observation_id":"05a35f45-341e-4709-92d2-1921aee36735","resolution":{"observed_at":"2026-08-01T11:38:19.374306Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.19793","last_updated":"2025-08-24T03:28:21Z","snapshot_observed_at":"2026-08-14T15:35:38.720321Z","submitted_at":"2025-04-28T13:36:43Z","title":"Prompt Injection Attack to Tool Selection in LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.19793","snapshot_observed_at":"2026-08-01T11:38:19.451019Z","title":"Prompt injection attack to tool selection in llm agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:19.451019Z"},"links":{"cited_paper":"/paper/2504.19793","citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:167500473b328681e8108f8a3deef82f25755527e40eec0a5c27f2017c9c51b0","observation_id":"884ac497-cf9b-4395-bf92-330b86f12931","resolution":{"observed_at":"2026-08-01T11:38:19.451019Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:19.527776Z","title":"Obliinjection: Order-oblivious prompt injection attack to llm agents with multi-source data,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:19.527776Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:fe6e09261e9c6da82c17788789186d87716c43e30c3a6be7523bcae587648918","observation_id":"10044431-dfe8-496f-a514-cc53671bdb1a","resolution":{"observed_at":"2026-08-01T11:38:19.527776Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-19T11:00:12.093868Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-08-01T11:38:19.674889Z","title":"Agentvigil: Generic black-box red-teaming for indirect prompt injection against llm agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:19.674889Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:94f23296c1814c6b68efe38f022e417735d71bc6af94b508357c6e0bad5d5770","observation_id":"1b17e9f1-3daf-4a2b-ae26-da210751b368","resolution":{"observed_at":"2026-08-01T11:38:19.674889Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:19.816027Z","title":"Autohijacker: Automatic indirect prompt injection against black-box LLM agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:19.816027Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:3282ab0328967895e20d3fe3e115fdb5c44e2a5277f7ef8ec3af4409ac09e668","observation_id":"6d20f8c5-8837-485e-9eb0-d048eb27d4b3","resolution":{"observed_at":"2026-08-01T11:38:19.816027Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:19.894752Z","title":"Agentxploit: End-to-end red-teaming for AI agents powdered by multi-agent systems,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:19.894752Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:d05fa9478e1b3601176b029d85bc8b48d1a42fb73650a3e46cef2f79e14f79d0","observation_id":"6f47252f-d67d-4d46-8782-9986e52a8ca1","resolution":{"observed_at":"2026-08-01T11:38:19.894752Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:19.997439Z","title":"Tooltweak: An attack on tool selection in llm-based agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:19.997439Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:79b0b11eed56e89572d11441734996f2d2c8fd191136a15c2c4146f2bf2a09e9","observation_id":"974b7850-a8c9-4c18-9a0c-1e312a6b0300","resolution":{"observed_at":"2026-08-01T11:38:19.997439Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:20.114753Z","title":"Verigrey: Greybox agent validation,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:20.114753Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:e10efb769cdfcb72b8f8cce1ab413645351c32449fe484deeb4a0102f2929387","observation_id":"2f16feac-0b42-4e09-95a7-4bc030cc665c","resolution":{"observed_at":"2026-08-01T11:38:20.114753Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2602.14211","last_updated":"2026-06-16T17:33:00Z","snapshot_observed_at":"2026-08-02T23:20:40.869423Z","submitted_at":"2026-02-15T16:09:48Z","title":"SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2602.14211","snapshot_observed_at":"2026-08-01T11:38:20.224853Z","title":"Skillject: Automating stealthy skill-based prompt injection for cod- ing agents with trace-driven closed-loop refinement,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:20.224853Z"},"links":{"cited_paper":"/paper/2602.14211","citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:ff8ff7658c153a3f08a4bb6d5b8a2efb44a093c4c98fa74a1b8bb500935e5590","observation_id":"00f2b1d0-3081-4e5a-bca5-0a832b70c9c2","resolution":{"observed_at":"2026-08-01T11:38:20.224853Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:20.324753Z","title":"Udora: A unified red teaming framework against llm agents by dynamically hijacking their own reasoning,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:20.324753Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:49242f5e8c855ae5c5d7a83a1d1dabc9f22930cda0a8de993b1bdb59cc3395fd","observation_id":"1f54a5ea-3e5e-4731-9dbf-5e8c0f3b8ecd","resolution":{"observed_at":"2026-08-01T11:38:20.324753Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:20.414827Z","title":"Bench- marking and defending against indirect prompt injection attacks on large language models,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:20.414827Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:82b2afe4e4934b7abfe8cee8ebc8f205ef56dc6bca6c09c2435597118f869597","observation_id":"506ddbd4-b000-4ee3-b561-3aacd36afb6c","resolution":{"observed_at":"2026-08-01T11:38:20.414827Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:20.545074Z","title":"Agent security bench (asb): Formalizing and benchmark- ing attacks and defenses in llm-based agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:20.545074Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:ff72fa1ab8531ed69465641ea91c783f0636d103cf0ad2b11c87b0d69dcb9b31","observation_id":"f29c388e-4120-4db7-8372-d5d81442e719","resolution":{"observed_at":"2026-08-01T11:38:20.545074Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.14738","last_updated":"2024-11-22T05:17:18Z","snapshot_observed_at":"2026-08-19T23:08:07.822911Z","submitted_at":"2024-11-22T05:17:18Z","title":"Universal and Context-Independent Triggers for Precise Control of LLM Outputs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.14738","snapshot_observed_at":"2026-08-01T11:38:20.754753Z","title":"Universal and context-independent triggers for precise control of llm outputs,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:20.754753Z"},"links":{"cited_paper":"/paper/2411.14738","citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:876da993f32eddcb68daffccb52f45f00bfe963867aeb8cae7da769888a04d02","observation_id":"617e5efd-51f7-4608-ba58-8137230741e6","resolution":{"observed_at":"2026-08-01T11:38:20.754753Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:20.844901Z","title":"Trojan’s whisper: Stealthy manipulation of openclaw through injected bootstrapped guidance,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:20.844901Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:ec58fbc0b9edb2efc1d3a11361731b8e67b6f6282ff44789cf68fbbf62f367b0","observation_id":"9df13c94-2b54-4595-8378-68e2012e0a89","resolution":{"observed_at":"2026-08-01T11:38:20.844901Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:20.934753Z","title":"Openclaw docs,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:20.934753Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:03124e6f5695363c5894c3624d4d54d504b78eded8d188b7978959f33f219bea","observation_id":"4c3c54a5-a722-4862-8002-5e1b296c0bc4","resolution":{"observed_at":"2026-08-01T11:38:20.934753Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T11:38:21.054852Z","title":"Fine-tuned deberta-v3-base for prompt injection detection,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:21.054852Z"},"links":{"citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:76d2ada3ce2f1d0ae26ba67612f3d8cd6c56e721d950d8dfde296d856307128d","observation_id":"eb9eb1ff-679c-4e82-b893-34f5e6c0727a","resolution":{"observed_at":"2026-08-01T11:38:21.054852Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14720","last_updated":"2024-03-20T15:26:23Z","snapshot_observed_at":"2026-08-20T21:11:43.445033Z","submitted_at":"2024-03-20T15:26:23Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.14720","snapshot_observed_at":"2026-08-01T11:38:21.167591Z","title":"Defending against indirect prompt injection attacks with spotlight- ing,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:21.167591Z"},"links":{"cited_paper":"/paper/2403.14720","citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:caae5c14658e827b62c0920b9fcbc161ffaad674fe99b35a751d19cd391db346","observation_id":"1a8d5faf-b4fd-4723-adea-a3a4f4635572","resolution":{"observed_at":"2026-08-01T11:38:21.167591Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.14315","last_updated":"2022-12-29T14:11:07Z","snapshot_observed_at":"2026-08-19T20:12:46.708021Z","submitted_at":"2022-12-29T14:11:07Z","title":"\"Real Attackers Don't Compute Gradients\": Bridging the Gap Between Adversarial ML Research and Practice","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.14315","snapshot_observed_at":"2026-08-01T11:38:19.047650Z","title":"Available: https://arxiv.org/abs/2212.14315","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":2022,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:19.047650Z"},"links":{"cited_paper":"/paper/2212.14315","citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:5716d5b54a7dad15dd839bfd9e6b4c87d278f1b461c1042d7d93322b960b87e8","observation_id":"0bf5d298-f643-4924-88c2-b4ec411cc881","resolution":{"observed_at":"2026-08-01T11:38:19.047650Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","latest_version":1,"primary_category":"cs.AI","snapshot_observed_at":"2026-08-19T16:28:29.476799Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents"},"reference_resolution":{"displayed":36,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":36,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":36},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"thesis":"As of 22 August 2026, this Paper Citation Record lists 36 of 36 outbound references and 0 inbound Pith citation observations for arXiv:2607.19837."}