{"as_of":"2026-08-07T17:55:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:482af1748f20e601dda476b99d29afad2ff7cf16f22e7609749f63d5488972e1","coverage":[{"denominator":27,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":27,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T04:17:02.594840Z","state":"measured"},{"denominator":27,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":27,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-07T06:34:17.273281+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.00747/citation-record","integrity":"/paper/2608.00747/integrity","json":"/paper/2608.00747/citation-record.json","paper":"/paper/2608.00747"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2211.09527","last_updated":"2022-11-17T13:43:20Z","snapshot_observed_at":"2026-07-06T14:19:47.424778Z","submitted_at":"2022-11-17T13:43:20Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2211.09527","snapshot_observed_at":"2026-08-05T04:17:02.494770Z","title":"Ignore previous prompt: Attack techniques for language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.494770Z"},"links":{"cited_paper":"/paper/2211.09527","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:41df29625bbae5bffa009f485b101907759533f61f53e9211045b7d4601f8f1e","observation_id":"bb170696-a993-47e8-ac53-8a7eea8e35f0","resolution":{"observed_at":"2026-08-05T04:17:02.494770Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.499370Z","title":"Not what you’ve signed up for: Compromising real- world llm-integrated applications with indirect prompt injection,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.499370Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:371d1a2c394f80dcb7831f72966c8ac7648c4fe49942f6ea7d5506acfb775cfc","observation_id":"e51ae8f8-dfe0-4058-aeab-bfe27432df12","resolution":{"observed_at":"2026-08-05T04:17:02.499370Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.06322","last_updated":"2025-01-10T19:56:50Z","snapshot_observed_at":"2026-07-30T22:07:13.869232Z","submitted_at":"2025-01-10T19:56:50Z","title":"Multi-Agent Collaboration Mechanisms: A Survey of LLMs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.06322","snapshot_observed_at":"2026-08-05T04:17:02.503427Z","title":"Multi-agent collaboration mechanisms: A survey of llms,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.503427Z"},"links":{"cited_paper":"/paper/2501.06322","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:13035aad39a79cf9b5abf9832e98ebaeef0c6ee22e5ca4fd3234bd0bcd1b8fcb","observation_id":"7c2b1b60-bd8f-485e-ba4e-d4076050b839","resolution":{"observed_at":"2026-08-05T04:17:02.503427Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.507970Z","title":"A survey of llm-driven ai agent communication: Protocols, security risks, and defense countermeasures,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.507970Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:a5bd0d9c6ba95ea39bd1d4b42f005d94686c0907a117dbc755d7ce370afef526","observation_id":"ce38dc26-2af1-4fe8-ab2e-b556bf871fa2","resolution":{"observed_at":"2026-08-05T04:17:02.507970Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.19793","last_updated":"2025-08-24T03:28:21Z","snapshot_observed_at":"2026-08-01T07:24:09.967062Z","submitted_at":"2025-04-28T13:36:43Z","title":"Prompt Injection Attack to Tool Selection in LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.19793","snapshot_observed_at":"2026-08-05T04:17:02.512504Z","title":"Prompt injection attack to tool selection in llm agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.512504Z"},"links":{"cited_paper":"/paper/2504.19793","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:92eda78c2379dbe97f7658add627eeaaa8b658461b19a802696ccd8d1394b9b0","observation_id":"b3b9ed97-2620-415b-96a6-711d66e37531","resolution":{"observed_at":"2026-08-05T04:17:02.512504Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.516491Z","title":"Agentpoison: Red- teaming llm agents via poisoning memory or knowledge bases,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.516491Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:953dd1f4f07db8aa4381e9b5e454914923d3afae7b252876e743166ac66e780f","observation_id":"558cf644-7c68-49fd-9844-57c81c380287","resolution":{"observed_at":"2026-08-05T04:17:02.516491Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.520587Z","title":"Memory injection attacks on llm agents via query-only interaction,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.520587Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:167f6fb439c04b111d6b7144cd78ff26248f1855c9da2af08b90586fc05f20cb","observation_id":"f5e615bf-34cc-4b35-992c-a4881832719f","resolution":{"observed_at":"2026-08-05T04:17:02.520587Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.524559Z","title":"Prompt infection: Llm-to-llm prompt injection within multi-agent systems,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.524559Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:e7116f0e81c5636826295e9bae1648210676ae651457c8783a5b8b297f0bc785","observation_id":"b85e4991-a6ec-41a2-ab09-3bd45cd0dd9f","resolution":{"observed_at":"2026-08-05T04:17:02.524559Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.01680","last_updated":"2024-04-19T01:15:16Z","snapshot_observed_at":"2026-08-06T19:10:15.466826Z","submitted_at":"2024-01-21T23:36:14Z","title":"Large Language Model based Multi-Agents: A Survey of Progress and Challenges","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.01680","snapshot_observed_at":"2026-08-05T04:17:02.527779Z","title":"Large language model based multi-agents: A survey of progress and challenges,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.527779Z"},"links":{"cited_paper":"/paper/2402.01680","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:e826ac702d8d53c1bca03bffb75c06f43f86e36b4eebc5edfa8afac7166b2cb9","observation_id":"a13f49f7-e8f2-4232-9e0b-09ee727c3222","resolution":{"observed_at":"2026-08-05T04:17:02.527779Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.12442","last_updated":"2025-06-17T15:37:58Z","snapshot_observed_at":"2026-08-07T15:43:38.945053Z","submitted_at":"2025-05-18T14:31:45Z","title":"IP Leakage Attacks Targeting LLM-Based Multi-Agent Systems","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.12442","snapshot_observed_at":"2026-08-05T04:17:02.531826Z","title":"Ip leakage attacks targeting llm-based multi-agent systems,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.531826Z"},"links":{"cited_paper":"/paper/2505.12442","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:a8b551d439000a8b15d6620c912bc8ac59c559c6ee00e66c1f30e484122c626d","observation_id":"d1181928-a6dd-4bc4-81e2-21c2891f11cb","resolution":{"observed_at":"2026-08-05T04:17:02.531826Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T04:17:02.535609Z","title":"Multi-agent systems execute arbitrary malicious code,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.535609Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:5a955a88c2355eb4808dede4a96aaadc90f67625922026c4e2609f86fdef7106","observation_id":"df05d453-c18f-46f1-af60-291b8c858210","resolution":{"observed_at":"2026-08-05T04:17:02.535609Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.539306Z","title":"Red-teaming llm multi-agent systems via communication attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.539306Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:f3a416fec6297d06a89c0145906dfdabb97894185361528bdffa599ddc54d5da","observation_id":"a261c141-7ae3-4579-b997-dfd297475108","resolution":{"observed_at":"2026-08-05T04:17:02.539306Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.543199Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.543199Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:3aabebf7217ae4ebe61a45ef9be2ad6d976b8c5148da04327678ed2009cc51d4","observation_id":"8af621a0-4dd1-4298-be2e-110119c99a48","resolution":{"observed_at":"2026-08-05T04:17:02.543199Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20242","last_updated":"2026-06-09T05:19:18Z","snapshot_observed_at":"2026-07-06T18:53:31.241776Z","submitted_at":"2024-07-16T13:13:16Z","title":"BadRobot: Jailbreaking Embodied LLM Agents in the Physical World","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20242","snapshot_observed_at":"2026-08-05T04:17:02.546665Z","title":"Badrobot: Jailbreaking embodied llms in the physical world,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.546665Z"},"links":{"cited_paper":"/paper/2407.20242","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:0cf1474beeffc3ccb70139996fc44be66a935ac6957dcaac888429e8605ba976","observation_id":"59e1107c-10eb-4979-88e4-7a47f7bb4241","resolution":{"observed_at":"2026-08-05T04:17:02.546665Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.550312Z","title":"A study on prompt injection attack against llm-integrated mobile robotic systems,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.550312Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:c3fc8519c06a86f246cfff99fab504d49e19998eac97aea61a49f8ed741acf82","observation_id":"92ca83d1-8370-4254-a965-5d995bd50553","resolution":{"observed_at":"2026-08-05T04:17:02.550312Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.553854Z","title":"Long-horizon planning for multi- agent robots in partially observable environments,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.553854Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:45029ed2775a70abf59630d082fe15f0050c75dc63c80e3598a6e618088bb8a1","observation_id":"780ac79f-a127-4fe2-a6d8-35f377c52541","resolution":{"observed_at":"2026-08-05T04:17:02.553854Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.557683Z","title":"AI2-THOR: An Interactive 3D Environment for Visual AI,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.557683Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:054c506ef8bb015f0be45d70d110b495bb286aea9eeab18b9349c69b84c17a6a","observation_id":"b770397f-38d6-4569-a686-d40e456a5ef4","resolution":{"observed_at":"2026-08-05T04:17:02.557683Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.561146Z","title":"Formalizing and benchmarking prompt injection attacks and defenses,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.561146Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:9644746755ddb844ba86df497c41194e4074c5c09085290c8af48b560e8eb041","observation_id":"94a70e48-81f1-47a6-b2e5-c5d52ffe3948","resolution":{"observed_at":"2026-08-05T04:17:02.561146Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.564492Z","title":"Injecagent: Benchmark- ing indirect prompt injections in tool-integrated large language model agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.564492Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:b7713d9a1e274e12a151e0ff3c7a34f7eccd452d8cfae3c84752547a0f32ad16","observation_id":"5989c688-0522-4bc9-a1f1-35dda94cdeef","resolution":{"observed_at":"2026-08-05T04:17:02.564492Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.568841Z","title":"Jailbreaking llm-controlled robots,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.568841Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:3ca319ad4f6e8d5512cc6d5683576b255ba6a1a7cfba0786f3b8b14fbf9cdc00","observation_id":"c55359a1-2b3c-49f6-9650-7e85313e2762","resolution":{"observed_at":"2026-08-05T04:17:02.568841Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.573034Z","title":"Jailbreaking black box large language models in twenty queries,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.573034Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:bcfd5bfb73083cebcc236fca069dd68002b88980dccaeae2632c7a68d43e9fc6","observation_id":"f0d232bb-7615-44f2-9eb3-c775250afb6d","resolution":{"observed_at":"2026-08-05T04:17:02.573034Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.576515Z","title":"Agent security bench (asb): Formalizing and benchmarking attacks and defenses in llm-based agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.576515Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:eecec845005c4fcb4a4028941a83133dffac7adbeafbde00aaa8e918c65702bd","observation_id":"ccb795ea-410c-463e-b843-18a3122bd09c","resolution":{"observed_at":"2026-08-05T04:17:02.576515Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.08567","last_updated":"2024-06-03T14:15:03Z","snapshot_observed_at":"2026-07-06T17:29:34.813390Z","submitted_at":"2024-02-13T16:06:17Z","title":"Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.08567","snapshot_observed_at":"2026-08-05T04:17:02.580448Z","title":"Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.580448Z"},"links":{"cited_paper":"/paper/2402.08567","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:632fe2fd81e615dd0144b889feef52315406a14bf82e3b48bde3fa7969b8731e","observation_id":"3a84d894-086c-40ad-9149-71cfca548d58","resolution":{"observed_at":"2026-08-05T04:17:02.580448Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.584306Z","title":"Agents under siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.584306Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:54d69e6f0745782a59ab917aa943199f34884a1e535a0f37d2725dd2dd071199","observation_id":"f0902229-485e-4fd6-9b20-fbef892648d8","resolution":{"observed_at":"2026-08-05T04:17:02.584306Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.587650Z","title":"Sentence-bert: Sentence embeddings using siamese bert-networks,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.587650Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:57ce111a5d3873ae98642144d563ed9cbeb368b852d3bb1bca10781c06ddbf65","observation_id":"3b86aa3e-7ec1-4254-bdcd-bd320813b959","resolution":{"observed_at":"2026-08-05T04:17:02.587650Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.591154Z","title":"Image-based prompt injection: Hijacking multimodal llms through visually embed- ded adversarial instructions,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.591154Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:ae471c9aeeea1a801ca32dd5d95b24689137eb39eacf31016471b85b66f4d8c1","observation_id":"f4472c28-19f9-4a15-a6fe-6d667a43d765","resolution":{"observed_at":"2026-08-05T04:17:02.591154Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.04957","last_updated":"2024-03-07T23:46:20Z","snapshot_observed_at":"2026-07-06T17:41:19.171822Z","submitted_at":"2024-03-07T23:46:20Z","title":"Automatic and Universal Prompt Injection Attacks against Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.04957","snapshot_observed_at":"2026-08-05T04:17:02.594840Z","title":"Automatic and universal prompt injection attacks against large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.594840Z"},"links":{"cited_paper":"/paper/2403.04957","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:69da8c7862852e6cbced3532ddab559624604fb3f797b7716fde87f6ef69e855","observation_id":"7b3561d9-29b1-40cc-91cb-e557b307c12c","resolution":{"observed_at":"2026-08-05T04:17:02.594840Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","latest_version":2,"primary_category":"cs.RO","snapshot_observed_at":"2026-08-07T17:31:24.419786Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems"},"reference_resolution":{"displayed":27,"state_counts":{"malformed_identifier":1,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":26,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":27},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"thesis":"As of 7 August 2026, this Paper Citation Record lists 27 of 27 outbound references and 0 inbound Pith citation observations for arXiv:2608.00747."}