{"as_of":"2026-08-20T09:09:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:1fbddc70e622c546634cae8628bfdc6d7b004d4102c5f35c85545f72ffd0baf6","coverage":[{"denominator":55,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":55,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-06T17:42:06.624702Z","state":"measured"},{"denominator":55,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":55,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-20T06:33:59.587034+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.04741/citation-record","integrity":"/paper/2608.04741/integrity","json":"/paper/2608.04741/citation-record.json","paper":"/paper/2608.04741"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.554929Z","title":"A {Large-Scale} measurement of website login policies","venue":null,"work_id":"f58a12df-33b4-4f26-aa01-1a69476194dc","year":2023},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.441269Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:ed8937d27d0a449160a008c8a96d57cf2cea886b2ee15cccd85b8e3bbd8c9b68","observation_id":"0c06a9e7-cc4a-41a3-a311-3acce751fa83","resolution":{"observed_at":"2026-08-06T17:42:07.557607Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.547534Z","title":"Agentharm: A benchmark for measuring harmfulness of llm agents","venue":null,"work_id":"e166919d-eed5-49a8-914e-94e0ad501c25","year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.444995Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:257a2f62fcf6d159b79c9bbc2fcdfc2bd43743403e751ba0eb1e2a69d47feb53","observation_id":"bbb70c9c-5074-4cb9-bcee-d43731f71a45","resolution":{"observed_at":"2026-08-06T17:42:07.549913Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.540428Z","title":"Phishing activity trends report, 1st quarter 2025","venue":null,"work_id":"cead71d6-6e19-470e-a1c7-bcc2669de245","year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.448942Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:16d03ebcf46b5f295bea6670bced020419e62f9745fae56bf3190ff6a076efb7","observation_id":"5acbad47-b0d5-4a06-b076-814729825694","resolution":{"observed_at":"2026-08-06T17:42:07.542958Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.533395Z","title":"Car- bon: domain-independent automatic web form filling","venue":null,"work_id":"b2f8a1fa-3263-4d39-9714-8d725496d5f2","year":2010},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.452388Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:3f52fe93bef21b9908fdd48b4a242dc3727373fffd265a725d8ea1a5273a06d7","observation_id":"9d1c3dc1-7c75-4bf6-978e-34199d0c4a96","resolution":{"observed_at":"2026-08-06T17:42:07.536030Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:06.456309Z","title":"Vpi-bench: Visual prompt injection attacks for computer-use agents.arXiv preprint arXiv:2506.02456(2025)","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.456309Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:7ab89881df44741789732dfc19b2e7a679916119b1ea51689daedd55127bc171","observation_id":"0e5f3b4a-478e-4910-af57-2627c85cf3ea","resolution":{"observed_at":"2026-08-06T17:42:06.456309Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.524847Z","title":"Real: Benchmarking autonomous agents on deterministic simu- lations of real websites.Advances in Neural Information Processing Systems 38(2026)","venue":null,"work_id":"1a829c4c-fa0b-494d-96b8-99160404604a","year":2026},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.460070Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:e06960435b1e80253930e871a6eacc2ab650d63b8477f9bfe06a369f9a50acf9","observation_id":"ad6420f2-2139-4eaf-8765-ce1ef1f72e86","resolution":{"observed_at":"2026-08-06T17:42:07.528299Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.516373Z","title":"Efficient selectivity and backup operators in monte-carlo tree search","venue":null,"work_id":"ba477c2b-27f2-45e4-9dc4-5f5e8d8c5bf3","year":2006},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.463706Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:f310d2a86e8ffe0f414bba421209c98090b505cd8b6dceeef6812a0154f55060","observation_id":"f158a4ea-de03-4ef6-8d65-19e03acd5f2c","resolution":{"observed_at":"2026-08-06T17:42:07.520094Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:06.467683Z","title":"Decepticon: How dark patterns manipulate web agents.arXiv preprint arXiv:2512.22894(2025)","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.467683Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:86e6babcd62c516d5487e8dbc860de6c42a6464075133d52687d4d66e9c73aa0","observation_id":"1cd58b4e-a788-4296-a713-be06b18d6f92","resolution":{"observed_at":"2026-08-06T17:42:06.467683Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.506200Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents.Advances in Neural Information Processing Systems 37 (2024), 82895–82920","venue":null,"work_id":"72571757-7343-41b1-86c9-f7d159daa79f","year":2024},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.471130Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:fa6fbb66ffa5cbf2f449bec4742e3700c02714bec2e9229b21684d60c56519aa","observation_id":"cbfe2e78-bc94-496f-9be8-286b4bc748dc","resolution":{"observed_at":"2026-08-06T17:42:07.510037Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.499787Z","title":"Mind2web: Towards a generalist agent for the web","venue":null,"work_id":"d6c4717c-8bc2-42cb-b36c-13c90c763714","year":2023},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.474244Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:1d34402366fd86c8843678c7435669b2173faf374b9d35ecc32a1e23e3d4f153","observation_id":"98041349-4e5f-4039-b7e2-cabbc9b00a79","resolution":{"observed_at":"2026-08-06T17:42:07.502378Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.492795Z","title":"User-driven automation of web form filling","venue":null,"work_id":"b2ad0a1c-5b26-4913-9af6-87f7f4cc9941","year":2013},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.477936Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:8663d1d02414736d16b722b385cd1b54d5bdca1bf985d28188174f50ae55c886","observation_id":"64fb2902-695f-4237-8479-033aa5276a20","resolution":{"observed_at":"2026-08-06T17:42:07.495608Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:06.481121Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.481121Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:072383ef9ff4499766c50dbb8ab48a3bb5c6528bb03847c039e91e813ca9403d","observation_id":"bd13c105-9972-4f45-b0a2-4cdc8ba26691","resolution":{"observed_at":"2026-08-06T17:42:06.481121Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.485909Z","title":"Wasp: Benchmarking web agent security against prompt injection attacks.Advances in Neural Information Processing Systems 38(2026)","venue":null,"work_id":"27cf52e1-b87b-42e0-b0a7-d0e47dad1c24","year":2026},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.483589Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:d63416d9e6886a06355d8861a0e51bae09b926186ed30a20528fa78cabfa3b7e","observation_id":"88690090-5ea0-4a8d-b968-6d9ab6149e87","resolution":{"observed_at":"2026-08-06T17:42:07.489006Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.06159","last_updated":"2024-02-09T03:21:14Z","snapshot_observed_at":"2026-08-16T14:20:01.238866Z","submitted_at":"2024-02-09T03:21:14Z","title":"Passwords Are Meant to Be Secret: A Practical Secure Password Entry Channel for Web Browsers","version":1},"cited_work":{"arxiv_id":"2402.06159","doi":null,"metadata_source":"pith","pith_arxiv_id":"2402.06159","snapshot_observed_at":"2026-08-06T17:42:07.074636Z","title":"Passwords Are Meant to Be Secret: A Practical Secure Password Entry Channel for Web Browsers","venue":"cs.CR","work_id":"052b13b7-daef-4b6b-87bd-26d2424e17d1","year":2024},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.486460Z"},"links":{"cited_paper":"/paper/2402.06159","citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:a960973311187331b05c932eef020d537e8cda24792ea919f0be2863dddfee8d","observation_id":"9169ba28-1482-4e7d-bd6c-f70d72dd0ce4","resolution":{"observed_at":"2026-08-06T17:42:07.077682Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.478723Z","title":"{Topic-FlipRAG}:{Topic-Orientated} adversarial opinion manipulation attacks to {Retrieval-Augmented} generation models","venue":null,"work_id":"bcda8b8a-45a6-4417-a599-c44c64039c68","year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.490342Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:bfc265248c53644a431c5943b98949631fb4e2009d29df9b3c9dfa6dbee4af2b","observation_id":"b1b54759-65dc-4a4c-9bf3-ca097555ecea","resolution":{"observed_at":"2026-08-06T17:42:07.481653Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.469115Z","title":"Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection","venue":null,"work_id":"c60a3f3b-e49c-4171-a3b8-4bf75ca9fb99","year":2023},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.493016Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:a55150d5c42ae0001327f0f4c8f34079b8ced18ad995bdec606e6d068fc3347e","observation_id":"d0d057d8-569d-4618-9b7b-f4b5d13eabc5","resolution":{"observed_at":"2026-08-06T17:42:07.472923Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1812.09195","last_updated":"2018-12-21T15:32:59Z","snapshot_observed_at":"2026-08-15T04:17:33.893327Z","submitted_at":"2018-12-21T15:32:59Z","title":"Learning to Navigate the Web","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1812.09195","snapshot_observed_at":"2026-08-06T17:42:06.496941Z","title":"Learn- ing to navigate the web.arXiv preprint arXiv:1812.09195(2018)","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.496941Z"},"links":{"cited_paper":"/paper/1812.09195","citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:3d9baf865e59cf52325d5a8494ab0395645cab450c89c04e7e39b19d2abc3305","observation_id":"4e81c17a-611d-46bc-b011-853535dba31d","resolution":{"observed_at":"2026-08-06T17:42:06.496941Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.459257Z","title":"Webvoyager: Building an end-to-end web agent with large multimodal models","venue":null,"work_id":"6f0bd2fe-e445-481b-95bc-a8f4383b25c5","year":2024},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.501249Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:fed4fb76eccaadb393a2500582f64f3a5e1e5ec57883c83ff07d0e73004f1b12","observation_id":"f556136c-c0d8-4694-a7e7-9f8e43e436bf","resolution":{"observed_at":"2026-08-06T17:42:07.463047Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2507.14799","last_updated":"2025-07-20T03:10:13Z","snapshot_observed_at":"2026-08-18T03:07:34.267972Z","submitted_at":"2025-07-20T03:10:13Z","title":"Manipulating LLM Web Agents with Indirect Prompt Injection Attack via HTML Accessibility Tree","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2507.14799","snapshot_observed_at":"2026-08-06T17:42:06.503639Z","title":"Manipulating llm web agents with indirect prompt injection attack via html accessibility tree.arXiv preprint arXiv:2507.14799(2025)","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.503639Z"},"links":{"cited_paper":"/paper/2507.14799","citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:f06d4759b691bfd9a185c114869e4d662820a12b9078b3aded0d8dea5da018b2","observation_id":"3eb38f5c-10a0-4197-b87e-aa1006979022","resolution":{"observed_at":"2026-08-06T17:42:06.503639Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.451072Z","title":"Y., LO, R., JANG, L., DUVVUR, V., LIM, M","venue":null,"work_id":"b639b07d-89df-4d34-abf3-b0296d8e1caf","year":2024},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.507232Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:63c7e349c84a49a8f89e145c186883c2793fc37cbf0081993b39509e98ae998c","observation_id":"dd0301f5-87cb-46c7-a1cb-4ceebaac7e8c","resolution":{"observed_at":"2026-08-06T17:42:07.453400Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.442529Z","title":"Les dissonances: Cross-tool harvesting and polluting in pool-of-tools empowered llm agents","venue":null,"work_id":"e4adbe87-467e-4d4a-8add-3d6598b74848","year":2026},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.510133Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:3bdea115bd8303a03474a50d223acd7a80d776f1dd683271966eae19a776075a","observation_id":"f0f1bff5-1ea6-4d55-9d69-8a5293ff150e","resolution":{"observed_at":"2026-08-06T17:42:07.445671Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.435320Z","title":"Eia: Environmental injection attack on generalist web agents for privacy leakage","venue":null,"work_id":"5251c819-d5c8-46ab-b1ab-ed545f6fc34a","year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.513401Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:d8a604fcf96a38ccf935d3c2cb53c35909c9147d7d40c357531994951f8ddc9f","observation_id":"74fdf42b-fffa-4042-b859-5b2a870ec5c0","resolution":{"observed_at":"2026-08-06T17:42:07.438106Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.428053Z","title":"Fill in the blanks: Empirical anal- ysis of the privacy threats of browser form autofill","venue":null,"work_id":"110d1ad3-a5e7-49a5-be11-cd0462b55306","year":2020},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.516251Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:d4fc716d4d974bcc3000e3530dabcc991ef7c399a35ac8c6c684d2f6dac0fc01","observation_id":"db134c8c-9f2a-4ad0-8a8f-da11c4adf9af","resolution":{"observed_at":"2026-08-06T17:42:07.431435Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1802.08802","last_updated":"2018-02-24T05:32:47Z","snapshot_observed_at":"2026-08-14T19:42:39.161822Z","submitted_at":"2018-02-24T05:32:47Z","title":"Reinforcement Learning on Web Interfaces Using Workflow-Guided Exploration","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1802.08802","snapshot_observed_at":"2026-08-06T17:42:06.519204Z","title":"Z., GUU, K., PASUPAT, P., SHI, T.,ANDLIANG, P","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.519204Z"},"links":{"cited_paper":"/paper/1802.08802","citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:1337fbce3df11e487b64347f20936693a5c62ceeddff78183abefe4f4fda2204","observation_id":"fd2f45a7-0f85-4c9b-92ff-8bf5727f6610","resolution":{"observed_at":"2026-08-06T17:42:06.519204Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.420735Z","title":"H., DIVAKARAN, D","venue":null,"work_id":"58711595-67d1-4c85-b801-7a6a8104a4bd","year":2022},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.522980Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:75619eff963030b83896c02d8a7d2b35040021c0a73565f2ed6a1896f87d64e0","observation_id":"5ce63290-07de-4085-bc42-dd938674c723","resolution":{"observed_at":"2026-08-06T17:42:07.423512Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.412073Z","title":null,"venue":null,"work_id":"1964b0b4-9d21-44f7-b79d-46b6bd61d0ae","year":2024},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.525610Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:d4becf8e47ab78aad0079bb5ff63d0b4faa3508d2cc69a35a85a5af791c61af7","observation_id":"8f183b19-d169-487c-b4ff-4c3b85ae76ee","resolution":{"observed_at":"2026-08-06T17:42:07.415437Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:06.528977Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.528977Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:4a39f7380ed8ba08e159406e4a5bf150d6ceca950f38feaeaba0c6aa287b5ac3","observation_id":"80c3476e-d826-414c-b6c1-e9fb32e540c1","resolution":{"observed_at":"2026-08-06T17:42:06.528977Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.405123Z","title":"Microsoft digital defense report 2025","venue":null,"work_id":"3b5cd159-6b98-4bdb-9d29-7fcc40bf414a","year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.532986Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:83a2ce3a2eefbec8a9fec8ae8ce9a1ecc7b3ef81a28f597a6f56b0371afb2fa9","observation_id":"4cb0301f-ca33-4426-90d1-f27180b5cee9","resolution":{"observed_at":"2026-08-06T17:42:07.407692Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2601.09321","last_updated":"2026-08-12T10:30:27Z","snapshot_observed_at":"2026-08-19T17:52:45.946005Z","submitted_at":"2026-01-14T09:47:49Z","title":"SpatialJB: How Text Distribution Art Becomes the \"Jailbreak Key\" for LLM Guardrails","version":2},"cited_work":{"arxiv_id":"2601.09321","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":"2601.09321","snapshot_observed_at":"2026-08-13T02:21:51.267303Z","title":"jailbreak key","venue":null,"work_id":"dfe9238f-3e58-4dd8-8d1f-221302441934","year":2026},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.535475Z"},"links":{"cited_paper":"/paper/2601.09321","citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:d0d8fd6d51411d148cea0dd47258b112cb660ffda874ef4099891ed9587659c6","observation_id":"99be01bd-bb5f-4fe6-8c90-94cc13c7d254","resolution":{"observed_at":"2026-08-13T02:21:51.267303Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.399038Z","title":"Browser use: Enable ai to control your browser","venue":null,"work_id":"9293e686-1242-4e14-a48e-5547a7bd2159","year":2024},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.538520Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:e7a2cc935a39197f06713070a2537d3ecda94faff3f48cf6a373d62efabb7ffd","observation_id":"252ceac1-2319-47d1-90c0-8e32e40bd09d","resolution":{"observed_at":"2026-08-06T17:42:07.401393Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.392355Z","title":"Gui agents: A survey","venue":null,"work_id":"cc9bc85a-e246-4817-b8a4-8707f2bd7559","year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.541001Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:36b6f7126af5246481ed0e9dc51eee9e843fb4b63cf7479d4593d3eaf11f34b1","observation_id":"88004904-6b3a-4ba3-a68b-df5e5e96f444","resolution":{"observed_at":"2026-08-06T17:42:07.395115Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.385065Z","title":"End-to-end goal-driven web navigation","venue":null,"work_id":"f7f365f0-17fc-45cd-a2ee-3b6672d07ba5","year":2016},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.544346Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:0d1f3cf7f4b8a61a692d1efaacbd2b645a94691555917b70f8816ef0148f0632","observation_id":"1779d405-86c0-4cf4-b900-29843d6c9c87","resolution":{"observed_at":"2026-08-06T17:42:07.387856Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.375428Z","title":"What happens after you leak your password: Understanding cre- dential sharing on phishing sites","venue":null,"work_id":"23d41be0-c88e-4f99-a1c9-82daeeb9b165","year":2019},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.547617Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:a6de40cb8bb55200450a0bacc9f0285fc518f92840a2a04bfbeae80fadc184ad","observation_id":"dbc0865c-1e7f-4cc5-9122-d2e1bfb0ddde","resolution":{"observed_at":"2026-08-06T17:42:07.379481Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.367117Z","title":"How americans protect their online data","venue":null,"work_id":"715cb775-3ff6-446d-b378-a7826dd002ae","year":2023},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.550505Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:48ef27bf20d206acb25f2bf8ca07dd98fe3bf712ed407456ca808f39f31aa072","observation_id":"12a1ef06-0e46-4973-a765-3626768f5672","resolution":{"observed_at":"2026-08-06T17:42:07.369918Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2606.00497","last_updated":"2026-05-30T03:00:28Z","snapshot_observed_at":"2026-08-12T13:54:40.570261Z","submitted_at":"2026-05-30T03:00:28Z","title":"\"I Strongly Suspect This Website Is a Scam\": Benchmarking PII Leakage and Detection without Defense in Autonomous Web Agents","version":1},"cited_work":{"arxiv_id":"2606.00497","doi":null,"metadata_source":"pith","pith_arxiv_id":"2606.00497","snapshot_observed_at":"2026-08-06T17:42:06.925306Z","title":"\"I Strongly Suspect This Website Is a Scam\": Benchmarking PII Leakage and Detection without Defense in Autonomous Web Agents","venue":"cs.CR","work_id":"78db579c-92e3-41c6-93e6-73b9cea98222","year":2026},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.553219Z"},"links":{"cited_paper":"/paper/2606.00497","citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:a1b8133d8ecbc38efc6335e33f75e54e6816af4e28c3c314f33a80a5b7bc3144","observation_id":"c06644a6-cc01-4d17-a71d-64035d285fb8","resolution":{"observed_at":"2026-08-06T17:42:06.930325Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.358806Z","title":"Z.,ANDSUN, L","venue":null,"work_id":"fd857564-780a-41d0-ae0a-ce66ff8e612e","year":2026},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.558419Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:bf005e2d50e84e74b8034fb760213d52e5cb07bd164a04582075736cc569a50a","observation_id":"980ac03b-fc92-405a-b24a-5bb18d7e2641","resolution":{"observed_at":"2026-08-06T17:42:07.361662Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.350904Z","title":"World of bits: An open-domain platform for web-based agents","venue":null,"work_id":"a3829471-442d-4b48-a53c-e841e377c49c","year":2017},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.561858Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:a02a08d3c2fc66dbd250d9c344874ab8f044837819e0cbce5d47fbc48271a421","observation_id":"3e00ce7f-bae1-498d-be9c-9ce6750c1174","resolution":{"observed_at":"2026-08-06T17:42:07.353417Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.343682Z","title":"Password managers: Attacks and defenses","venue":null,"work_id":"012be33b-0f09-49e1-b16b-79720dd17844","year":2014},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.565314Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:b649d43ae0dacbcfb17ad0bbdded6b0193c23edb7cee10f11aa3cee338f74d46","observation_id":"07fd7f01-41c4-4f9a-b5f7-00583a0d33eb","resolution":{"observed_at":"2026-08-06T17:42:07.346163Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.335635Z","title":"Skyvern: Automate browser-based workflows with ai","venue":null,"work_id":"29192174-5af7-4b96-b9c8-7e4891485237","year":2024},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.568168Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:57f29d01cd730ff42e41d8be14c31b4152db3a70f4584524d3bb6d38af1a7af0","observation_id":"04f8fd7c-377f-4e73-99be-7a66ead02a61","resolution":{"observed_at":"2026-08-06T17:42:07.339219Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:06.570867Z","title":"Muzzle: Adap- tive agentic red-teaming of web agents against indirect prompt injection attacks.arXiv preprint arXiv:2602.09222(2026)","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.570867Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:4c0c995431c8df1203b9ecfdf82924662f8f33f9b39413d2ed7fc6144bf6d168","observation_id":"0fcea2bc-3e8e-4d16-8cd4-fa9888a91f5e","resolution":{"observed_at":"2026-08-06T17:42:06.570867Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.325457Z","title":"G., SZALACHOWSKI, P.,ANDZHOU, J","venue":null,"work_id":"788541e9-b55d-4fb7-845d-f82314b17123","year":2022},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.573544Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:664ae97a0a3d2afe516b77ee32f26880c7bd8b06257e48bc68bb64bf51743af7","observation_id":"9af78636-577a-4b5a-8f48-6062d9f584e7","resolution":{"observed_at":"2026-08-06T17:42:07.329024Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.318355Z","title":"Digital iden- tity guidelines: Authentication and authenticator management","venue":null,"work_id":"68e94bc4-9cba-433b-92df-3fef173253ec","year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.576792Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:96d1709d97923acb5b6d5a492859f1a08353614505257ce81c99106359ccb5c8","observation_id":"c8c6b994-563d-4f5b-bc15-b86eb36bd7e6","resolution":{"observed_at":"2026-08-06T17:42:07.320741Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-20T05:25:28.868240Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.21499","snapshot_observed_at":"2026-08-06T17:42:06.580319Z","title":"Adinject: Real-world black-box attacks on web agents via advertising delivery.arXiv preprint arXiv:2505.21499(2025)","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.580319Z"},"links":{"cited_paper":"/paper/2505.21499","citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:7a7c0fdbb7a70d1408ecc1a479bb375668823e87f3c2fe98aa03301dcf32a846","observation_id":"1142396f-0fe4-428f-bee7-3bece7f94629","resolution":{"observed_at":"2026-08-06T17:42:06.580319Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.310172Z","title":"Manipulating multimodal agents via cross- modal prompt injection","venue":null,"work_id":"ec01c867-ea76-454d-ad5b-c0c0e3eee44c","year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.584591Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:c7ead48b23451f9eaec8057ad86e49a9316e72f250d330a9680a9be7cd9e1b39","observation_id":"83b5c4e0-e0bd-4249-9a3d-fe8153ca95b0","resolution":{"observed_at":"2026-08-06T17:42:07.312746Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.302581Z","title":null,"venue":null,"work_id":"af3faa21-87cd-4772-b761-cbc131bf4ad9","year":2026},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.588212Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:a153fffc59f887a739de44431d8b729167293e2ae35a56907e34e2cc1e25af5a","observation_id":"338f8c91-f9aa-4c65-a91f-fe7a5c9d29c9","resolution":{"observed_at":"2026-08-06T17:42:07.305170Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:06.591770Z","title":"When bots take the bait: Exposing and mitigating the emerging social engineering attack in web automation agent.arXiv preprint arXiv:2601.07263(2026)","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.591770Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:a20850900041999e3cd0280acd7b27c79b45e0664c5d7c4706e41e889d60f387","observation_id":"179b35f2-f90c-41d4-a017-2343d6a87226","resolution":{"observed_at":"2026-08-06T17:42:06.591770Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.296062Z","title":"H., GOU, B., SONG, D., SUN, H.,ANDSU, Y","venue":null,"work_id":"25765465-6026-4e51-9984-ba8638feff57","year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.595198Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:980c21eaaa9c9bee1e7a43ceff50b19ff85a8c694673be1f0667664144b73f07","observation_id":"d3e666f8-28a9-48fe-9248-200d80e88cf5","resolution":{"observed_at":"2026-08-06T17:42:07.298374Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.11441","last_updated":"2023-11-06T07:39:49Z","snapshot_observed_at":"2026-08-12T21:25:32.312122Z","submitted_at":"2023-10-17T17:51:31Z","title":"Set-of-Mark Prompting Unleashes Extraordinary Visual Grounding in GPT-4V","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.11441","snapshot_observed_at":"2026-08-06T17:42:06.598082Z","title":"Set-of- mark prompting unleashes extraordinary visual grounding in gpt-4v","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.598082Z"},"links":{"cited_paper":"/paper/2310.11441","citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:1ce259ca90243402c51794fd255d66960536e771dfd48f123a1343fa94ac5314","observation_id":"19ac1970-eca5-43c4-88ee-1e11290094cc","resolution":{"observed_at":"2026-08-06T17:42:06.598082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.288081Z","title":"Litewebagent: The open-source suite for vlm-based web-agent applications","venue":null,"work_id":"13b82201-e8ff-4b87-a0e9-8f197452ea2f","year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.601738Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:de3eba44d5b3a2dc2be4fff27d6016df0f88c8c8e32ac9407ec5b726b35b0efc","observation_id":"567715ce-6635-461d-a14c-4e476672590f","resolution":{"observed_at":"2026-08-06T17:42:07.291537Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.279446Z","title":"Agent security bench (asb): Formalizing and benchmarking attacks and defenses in llm-based agents","venue":null,"work_id":"f9c42373-b250-4ae9-94d0-8ad24ded55d3","year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.604592Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:601fc326b8ed09670944e900ba8786581f28a3b5f77f5d252b3299125deb259d","observation_id":"01ceb5ba-e222-49c5-ab72-31ab857d465a","resolution":{"observed_at":"2026-08-06T17:42:07.282052Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:06.609002Z","title":"Browsesafe: Understanding and preventing prompt in- jection within ai browser agents.arXiv preprint arXiv:2511.20597 (2025)","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.609002Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:25f9910b1d7d3af7da5ce2f0fc7e9b2f15834b858f6df1951d62c6f70a815b35","observation_id":"28fdadac-9531-407c-aafd-87a204207c0f","resolution":{"observed_at":"2026-08-06T17:42:06.609002Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.271155Z","title":"Attacking vision-language com- puter agents via pop-ups","venue":null,"work_id":"b5967fde-d040-4e95-a328-4b66330f6831","year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.613121Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:7fa66f6a4d71df856f338cd24f72fec63a3f92d9207539e9aac99adad2de2f47","observation_id":"aad90a79-e894-460f-aeac-fe09729d0771","resolution":{"observed_at":"2026-08-06T17:42:07.273747Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:06.616784Z","title":"Genesis: Evolving attack strategies for llm web agent red-teaming.arXiv preprint arXiv:2510.18314(2025)","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.616784Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:ab64c116717b18c8b23a1ad9e0f171edc42a8e52c7db942dfb4a50a24981f1e0","observation_id":"f076ef29-57d8-48f7-8b1a-316dd3d74edc","resolution":{"observed_at":"2026-08-06T17:42:06.616784Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2509.06572","last_updated":"2026-05-01T11:41:26Z","snapshot_observed_at":"2026-08-14T23:56:29.912718Z","submitted_at":"2025-09-08T11:35:32Z","title":"Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2509.06572","snapshot_observed_at":"2026-08-06T17:42:06.620914Z","title":"Mind your server: A systematic study of parasitic toolchain attacks on the mcp ecosystem.arXiv preprint arXiv:2509.06572(2025)","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.620914Z"},"links":{"cited_paper":"/paper/2509.06572","citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:2448cc97e70244455818f330dde6f9ecf215202d81c187dbe899a431e98827d6","observation_id":"234e6629-8eba-4481-9c64-4bcaa4b15888","resolution":{"observed_at":"2026-08-06T17:42:06.620914Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T17:42:07.261492Z","title":"{PoisonedRAG}: Knowl- edge corruption attacks to {Retrieval-Augmented} generation of large language models","venue":null,"work_id":"b3363330-0b84-48d4-bdfa-434151db83a0","year":2025},"citing_paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-06T17:42:06.624702Z"},"links":{"citing_paper":"/paper/2608.04741"},"observation_digest":"sha256:026ca627886936824141f8b28db50241efce0866f882dd1a6075ec341ae6d9de","observation_id":"39ceafb1-fa49-4336-94f0-dd0c54496b15","resolution":{"observed_at":"2026-08-06T17:42:07.264825Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2608.04741","last_updated":"2026-08-05T12:08:16Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-20T06:46:50.424287Z","submitted_at":"2026-08-05T12:08:16Z","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents"},"reference_resolution":{"displayed":55,"state_counts":{"malformed_identifier":0,"metadata_mismatch":1,"parse_uncertain":0,"unresolved":16,"verified_exact":2,"verified_fuzzy":36},"total_outbound_references":55},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"thesis":"As of 20 August 2026, this Paper Citation Record lists 55 of 55 outbound references and 0 inbound Pith citation observations for arXiv:2608.04741."}