{"as_of":"2026-08-09T16:26:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:e8b3f2cd551d03dbdd3ef185ddcab04fbc8aab1b844ee2e3348e37b83e0957ea","coverage":[{"denominator":55,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":55,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-06T05:11:49.315668Z","state":"measured"},{"denominator":55,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":55,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.05108/citation-record","integrity":"/paper/2608.05108/integrity","json":"/paper/2608.05108/citation-record.json","paper":"/paper/2608.05108"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:45.154237Z","title":"Ignore previous prompt: Attack techniques for language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.154237Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:ba637b225e029d0137ab6686f0b70a0c9d7b8cc2e217f908e6dca266bfe276cc","observation_id":"ce8157a8-3198-4805-9f11-09358257bf05","resolution":{"observed_at":"2026-08-06T05:11:45.154237Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:56.733810Z","title":"Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,","venue":null,"work_id":"73249263-f026-4a9e-8e0c-4b3151bcf7df","year":2023},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.267686Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:240745f79097656db2ef9b0926d6623114f2caae079f60a79c03a4c1cc0002af","observation_id":"f2f22714-4efa-45ed-94b5-9bd9f4957670","resolution":{"observed_at":"2026-08-06T05:11:56.781256Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:56.604725Z","title":"Formalizing and benchmarking prompt injection attacks and defenses,","venue":null,"work_id":"46ba05a0-7de1-4698-be00-5df52a24f8bb","year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.327186Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:43717e79ea8346064568461ce509a69c542081c592a6996a7c4d827fec5c7859","observation_id":"bd61774f-d9cd-4278-95d3-dcd980725294","resolution":{"observed_at":"2026-08-06T05:11:56.674740Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:56.371338Z","title":"Injecagent: Benchmarking indirect prompt injections in tool- integrated large language model agents,","venue":null,"work_id":"f119171e-ee31-4021-8d20-621f9edabe9f","year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.414814Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:b4cf2353428861bf4013f089dff96cda1385e2d060f9e583e294050d272b38a1","observation_id":"76d5a701-c412-4fe4-a7c4-3195dff7f224","resolution":{"observed_at":"2026-08-06T05:11:56.473490Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:56.234630Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents,","venue":null,"work_id":"5ecff1c2-136b-49d6-9d6e-5a3701c38019","year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.463507Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:de0da0176a1519183ce327ddb969ffe0b7121fdfa02f01d52d0c81d47b3c6682","observation_id":"bde26fa6-ac1b-4460-aa32-edc540ebccec","resolution":{"observed_at":"2026-08-06T05:11:56.289540Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.09023","last_updated":"2025-10-10T05:51:04Z","snapshot_observed_at":"2026-08-03T03:11:42.084785Z","submitted_at":"2025-10-10T05:51:04Z","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2510.09023","snapshot_observed_at":"2026-08-06T05:11:45.495675Z","title":"The attacker moves second: Stronger adaptive attacks bypass defenses against llm jailbreaks and prompt injections,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.495675Z"},"links":{"cited_paper":"/paper/2510.09023","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:3d792d4a287ad846042695d770d0d96a9369892bab898739cd5ff30b32feda5c","observation_id":"14016feb-d5b0-4dd6-b8ab-4c41d96bc745","resolution":{"observed_at":"2026-08-06T05:11:45.495675Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:56.090195Z","title":"Muse spark safety & preparedness report,","venue":null,"work_id":"2f8eb31e-d668-4a90-b43c-88f7c7dcd14d","year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.604178Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:ca60a5be60be88bc7acf9156b89ec199fffbb4130cda4f3dab4b024342e0f759","observation_id":"7c719ede-b99a-4713-8f57-90f3d7c72b39","resolution":{"observed_at":"2026-08-06T05:11:56.149686Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:55.952660Z","title":"Claude opus 4.7 system card,","venue":null,"work_id":"d169a733-d83f-4b63-a71e-0413fae7e28b","year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.676598Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:42767c566525372efe2fb09e93448ba92d0f6d177f3ec7652222d1766dca3fba","observation_id":"16083f83-3eea-4cce-ac70-1f620f990eab","resolution":{"observed_at":"2026-08-06T05:11:56.015812Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:55.761051Z","title":"Datasentinel: A game-theoretic detection of prompt injection attacks,","venue":null,"work_id":"fc3fe01e-288b-4030-aac4-cc1e0aced5c2","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.725244Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:60c466a3ac344a46bf61be65500be28c3a40088b7d9a9882843de8f721142ed1","observation_id":"23e69e23-13f4-44f8-a68b-54603f45fa10","resolution":{"observed_at":"2026-08-06T05:11:55.853663Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:55.604410Z","title":"PromptGuard Prompt Injection Guardrail,","venue":null,"work_id":"fa24f3ff-ce25-47d2-9aa9-80f47776e72c","year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.794378Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:791a1a1c93d35b05c641c230e64459019ab4890022105856f5f84567ce11c634","observation_id":"a610dc2b-5572-47b4-ba4c-9b8222a28ea6","resolution":{"observed_at":"2026-08-06T05:11:55.674204Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.01194","last_updated":"2026-07-25T19:27:27Z","snapshot_observed_at":"2026-08-07T18:02:22.537986Z","submitted_at":"2026-04-01T17:40:03Z","title":"AgentWatcher: A Rule-based Prompt Injection Monitor","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.01194","snapshot_observed_at":"2026-08-06T05:11:45.854500Z","title":"Agentwatcher: A rule-based prompt injection monitor,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.854500Z"},"links":{"cited_paper":"/paper/2604.01194","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:b729c06042b0b788085170086fe8986d2763788ab7de6aa654279465744e15ac","observation_id":"f1bf1c37-421f-42e8-a85b-5263240f4e08","resolution":{"observed_at":"2026-08-06T05:11:45.854500Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:45.943166Z","title":"Meta secalign: A secure foundation llm against prompt injection attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.943166Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:d2e59330229bacebfa691ab46f0ef102b6911cc4b6179f2a4ced7423debf431d","observation_id":"cb5317d7-a23e-4772-8e0c-cd71d6462d0b","resolution":{"observed_at":"2026-08-06T05:11:45.943166Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.01850","last_updated":"2024-07-01T23:25:30Z","snapshot_observed_at":"2026-08-01T03:52:37.266248Z","submitted_at":"2024-07-01T23:25:30Z","title":"Purple-teaming LLMs with Adversarial Defender Training","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.01850","snapshot_observed_at":"2026-08-06T05:11:45.995659Z","title":"Purple-teaming llms with adversarial defender training,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.995659Z"},"links":{"cited_paper":"/paper/2407.01850","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:8547d418c9d26fc281280f648acb176310486c302443d59efd9de26cab7ad011","observation_id":"fccb7cd8-214d-4419-9e71-61df4f9a1633","resolution":{"observed_at":"2026-08-06T05:11:45.995659Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:55.495061Z","title":"Black-box red-teaming of multi-agent systems via reinforcement learning,","venue":null,"work_id":"c37fe130-22c0-42e7-a3dc-5c20648730aa","year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.063263Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:3dc07b9bf2f7f22d585f3370628f091cc0c507da16f7eb8fe03dedb683329f24","observation_id":"128eff0f-a175-4f43-85ee-a0e8d2807bf2","resolution":{"observed_at":"2026-08-06T05:11:55.546133Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2602.05746","last_updated":"2026-06-10T08:55:54Z","snapshot_observed_at":"2026-08-03T04:13:45.517910Z","submitted_at":"2026-02-05T15:14:46Z","title":"Learning to Inject: Automated Prompt Injection via Reinforcement Learning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2602.05746","snapshot_observed_at":"2026-08-06T05:11:46.111393Z","title":"Learning to inject: Automated prompt injection via reinforcement learning,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.111393Z"},"links":{"cited_paper":"/paper/2602.05746","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:f853ee3fa2a020b912b8e516e736c2277499bed3dc7ac0efcf234b05505132f6","observation_id":"1506dadd-4cfc-4288-87d3-46cd75cdeb52","resolution":{"observed_at":"2026-08-06T05:11:46.111393Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:46.203274Z","title":"Rl is a hammer and llms are nails: A simple reinforcement learning recipe for strong prompt injection,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.203274Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:ea0fea42fb580d6b89efb0d6becc869df25f9233313d233278da2bee0649208d","observation_id":"6058760e-f676-4eeb-be9d-2d872b0e74d7","resolution":{"observed_at":"2026-08-06T05:11:46.203274Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2603.13026","last_updated":"2026-07-23T13:46:08Z","snapshot_observed_at":"2026-08-08T00:03:42.869870Z","submitted_at":"2026-03-13T14:34:54Z","title":"PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defenses","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2603.13026","snapshot_observed_at":"2026-08-06T05:11:46.310041Z","title":"Pismith: Reinforcement learning-based red teaming for prompt injection defenses,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.310041Z"},"links":{"cited_paper":"/paper/2603.13026","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:9b9fa85b6e2afe6a6d4a4b2ccdcd9d7f6e26bdac25bca4cce15c0d91b487d10f","observation_id":"f8e5973a-ec6c-48b5-8515-b3a7e9413797","resolution":{"observed_at":"2026-08-06T05:11:46.310041Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:46.382227Z","title":"Tree of attacks: Jailbreaking black-box llms automatically,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.382227Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:80eac7b292bc902b25652e3ea3032ea8a41be611ed6e52bbc8a9fda39136aacf","observation_id":"40477b0a-9b12-4a28-bfe1-36da9440ec23","resolution":{"observed_at":"2026-08-06T05:11:46.382227Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:46.449184Z","title":"Jailbreaking black box large language models in twenty queries,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.449184Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:cde13d4507d44069ddb93d40232fc37dbccc2a3d75d2e5d317b2805a4857c0c2","observation_id":"7986393b-053b-411a-9513-0af5e38c9095","resolution":{"observed_at":"2026-08-06T05:11:46.449184Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:55.267417Z","title":"Agentvigil: Automatic black-box red-teaming for indirect prompt injection against llm agents,","venue":null,"work_id":"793eda12-bcf0-40a4-82b5-ae2fe05590f8","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.532386Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:8bb8ff1fcec9fb61e0866397539a509d6686e12eb242e54d0f772b7a9e30e817","observation_id":"8b07b5e7-5bfc-4f94-a98d-05a9ccd7b76a","resolution":{"observed_at":"2026-08-06T05:11:55.370992Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:55.140944Z","title":"Piarena: A platform for prompt injection evaluation,","venue":null,"work_id":"5045b103-f083-4247-b3de-7a18977e3e49","year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.588128Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:fff42ff2970eeec9a020c03efa80f162f764d148b2acd5965a4bffa57e613364","observation_id":"975147fa-4954-4812-8b14-8f12eb3df08d","resolution":{"observed_at":"2026-08-06T05:11:55.198269Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:54.914605Z","title":"Gpt-red: Automated red teaming via self-play at scale","venue":null,"work_id":"5c391d22-49ff-4d56-b284-816c7882ff1e","year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.654896Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:edee68319b488d36b4a2b752f60ebf7722718dbd61a96a3a12218f3686a815b0","observation_id":"d4dae2ee-2ff0-427c-83aa-68f923b3ab64","resolution":{"observed_at":"2026-08-06T05:11:55.032827Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:46.711658Z","title":"How vulnerable are ai agents to indirect prompt injections? insights from a large-scale public competition,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.711658Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:a9ad6bc50a9dd8d3e5e9e8a2ec863d1ba7049da3f7e3d93995dfc50c56715cac","observation_id":"6b1bbc84-dceb-4cd5-8669-4c88c9828352","resolution":{"observed_at":"2026-08-06T05:11:46.711658Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:46.767256Z","title":"Muzzle: Adaptive agentic red-teaming of web agents against indirect prompt injection attacks,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.767256Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:500af6fde96f8a735f217ce75275dbd5b08e475ce70eb17592fb1168283a3ace","observation_id":"f286f7ff-181a-40e7-8e00-de6f0b86b501","resolution":{"observed_at":"2026-08-06T05:11:46.767256Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:54.665975Z","title":"Autodan- turbo: A lifelong agent for strategy self-exploration to jailbreak llms,","venue":null,"work_id":"54edfa8e-84a5-4776-b89a-1b8745647d9b","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.906206Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:d0fcba3f6ec7db2c5a96a2a96f028987793cf5658ce1d6bfd0bcbb09b3931236","observation_id":"66b2b30e-52df-4521-8173-9b09574fa6b6","resolution":{"observed_at":"2026-08-06T05:11:54.785109Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2605.04808","last_updated":"2026-05-06T11:59:48Z","snapshot_observed_at":"2026-07-06T23:17:33.252539Z","submitted_at":"2026-05-06T11:59:48Z","title":"DecodingTrust-Agent Platform (DTap): A Controllable and Interactive Red-Teaming Platform for AI Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.04808","snapshot_observed_at":"2026-08-06T05:11:46.996106Z","title":"Decodingtrust- agent platform (dtap): A controllable and interactive red-teaming platform for ai agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.996106Z"},"links":{"cited_paper":"/paper/2605.04808","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:3e8c50613147eb1f11f8e7d9db343977ffc66a12f497a5dc51a03c819f9ce0ae","observation_id":"773492fa-d159-4a91-b778-4d6aac32070e","resolution":{"observed_at":"2026-08-06T05:11:46.996106Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2210.03629","last_updated":"2023-03-10T01:00:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-10-06T01:00:32Z","title":"ReAct: Synergizing Reasoning and Acting in Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2210.03629","snapshot_observed_at":"2026-08-06T05:11:47.055268Z","title":"React: Synergizing reasoning and acting in language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.055268Z"},"links":{"cited_paper":"/paper/2210.03629","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:b815b7d0f2af9a255f4ed0b6a175ea26c94f5b5b3af545e602577856e0d53176","observation_id":"ef34a227-74f2-469e-9719-296058853a8b","resolution":{"observed_at":"2026-08-06T05:11:47.055268Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:54.386531Z","title":"Toolllm: Facilitating large language models to master 16000+ real-world apis,","venue":null,"work_id":"3880e049-8a14-4572-bee6-11652a99ae68","year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.096713Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:e8c0e4a74c4401fc6f611b0cf43b889da87a7c1836c11172a1ee0ae54862be88","observation_id":"83da0063-c6d1-44d6-ad44-f293bc8c0929","resolution":{"observed_at":"2026-08-06T05:11:54.496789Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:47.164645Z","title":"Autoharness: improving llm agents by automatically synthesizing a code harness,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.164645Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:e63460ef4f30d76c1a2dadbbcb808a407897019b3f7e347f542e1d555b61b0fe","observation_id":"e32db511-3395-4a05-b2f4-daa3e63dbbf3","resolution":{"observed_at":"2026-08-06T05:11:47.164645Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.04180","last_updated":"2025-06-09T05:15:47Z","snapshot_observed_at":"2026-08-08T23:12:45.901049Z","submitted_at":"2025-02-06T16:12:06Z","title":"Multi-agent Architecture Search via Agentic Supernet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.04180","snapshot_observed_at":"2026-08-06T05:11:47.247014Z","title":"Multi-agent architecture search via agentic supernet,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.247014Z"},"links":{"cited_paper":"/paper/2502.04180","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:d5a678806de993f4b608f86d517bd6f000434129a1f5f03ab2b8705061abcee1","observation_id":"3e3a3567-d74d-46e1-965d-21c61d8ce21a","resolution":{"observed_at":"2026-08-06T05:11:47.247014Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.07496","last_updated":"2024-06-11T17:32:21Z","snapshot_observed_at":"2026-07-06T18:29:04.294349Z","submitted_at":"2024-06-11T17:32:21Z","title":"TextGrad: Automatic \"Differentiation\" via Text","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.07496","snapshot_observed_at":"2026-08-06T05:11:47.342591Z","title":"Textgrad: Automatic","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.342591Z"},"links":{"cited_paper":"/paper/2406.07496","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:7bebac54b2f70a9739cb284b66d1f50d2bb8da34f2b734193bc53bdf1d0d463f","observation_id":"554b4a78-c0c9-49bb-8e1c-30dc5a1c2eaa","resolution":{"observed_at":"2026-08-06T05:11:47.342591Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:54.194006Z","title":"Test-time training with self-supervision for generalization under distribution shifts,","venue":null,"work_id":"fd0c2984-7e2c-45c9-92b8-acbbc3314b2a","year":2020},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.402594Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:3b2063426bdfe2858bffe95bfe4fee37546c13ed6a0d12c936824828d8bc397f","observation_id":"3c0af994-60f6-4303-96f5-c5a3d88969e6","resolution":{"observed_at":"2026-08-06T05:11:54.272634Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:53.937350Z","title":"Gemini CLI: An open-source AI agent for the terminal,","venue":null,"work_id":"8a89a2ce-c87c-4a43-9ef7-125a10709f3a","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.493187Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:4dabd8763c20f7ebe0a5764e422c794e0741467e147c18e9bd4a0979fffe466e","observation_id":"4761427b-17af-4cfc-94f1-f0fe0af33f58","resolution":{"observed_at":"2026-08-06T05:11:54.073223Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:53.702383Z","title":"Codex CLI: A lightweight coding agent that runs in your terminal,","venue":null,"work_id":"faf6d47a-1533-4d5b-a1f6-fd7583ed81ba","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.564559Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:e63918392082dfdf4315100194aa358c961a0de1403c7bfc33c02ad4eca209a8","observation_id":"5a1b9b39-aa08-4a74-b822-af031cc6d786","resolution":{"observed_at":"2026-08-06T05:11:53.825124Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:53.412972Z","title":"Claw code: A clean-room open-source coding-agent CLI,","venue":null,"work_id":"47023826-824c-4d31-971e-69609160d18e","year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.614225Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:a3bab44d9615119bd26e9593f5e8187fa52b890d2b8aeb3bc18ea1328ca93294","observation_id":"b8b85a14-c728-4f94-8f93-c37e7e3f8b8d","resolution":{"observed_at":"2026-08-06T05:11:53.561952Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:53.088238Z","title":"Hermes agent: An open-source self-hosted autonomous AI agent,","venue":null,"work_id":"ba328d59-84df-4c3d-bc66-cb681081da13","year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.654480Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:0822cd440414ae6b0c71cf62755a464e34c58abc8c167c5d6a6e033bcf15440d","observation_id":"c49965f8-9100-48da-8537-c1ebcda2ae54","resolution":{"observed_at":"2026-08-06T05:11:53.262640Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:52.931701Z","title":"Claude code: An agentic coding tool for the terminal,","venue":null,"work_id":"10b1184c-fc72-467f-b8fe-504bde347c4c","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.694271Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:3997f56546aac8e5d9c4bfb0831a46200f40e30af7fc2d386f7d69ac5f3b88c6","observation_id":"72716773-1290-4acc-85d2-783456d67671","resolution":{"observed_at":"2026-08-06T05:11:53.011248Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:52.717893Z","title":"Attention tracker: Detecting prompt injection attacks in llms,","venue":null,"work_id":"cd087c98-7f14-4a9e-a1d4-eaef4575d094","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.764775Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:9349c52aa094d4aa43c0804b322f262c1f76281a069bcab00cfae4c4c6b6f65d","observation_id":"03c25b03-505b-4056-9caa-f7d8060cf3a2","resolution":{"observed_at":"2026-08-06T05:11:52.823611Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:52.424077Z","title":"Piguard: Prompt injection guardrail via mitigating overdefense for free,","venue":null,"work_id":"b97858bb-4e44-4ecb-9519-119457995c95","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.844255Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:5db7d65a852c5a04dc496ad44f38c9bae73acb0e9020524d379a3fc753da1ab1","observation_id":"6bf302bb-3a4c-4b99-9e42-3f29ecb6f5dd","resolution":{"observed_at":"2026-08-06T05:11:52.534030Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:47.884895Z","title":"Pishield: Detecting prompt injection attacks via intrinsic llm features,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.884895Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:7e76037de0f0051fe83479134b2e1b200739e6490d72f2a0a8757adc30d0c655","observation_id":"4c31e5f5-4e0d-4b42-9b48-68ca1a65e058","resolution":{"observed_at":"2026-08-06T05:11:47.884895Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:47.889944Z","title":"Pisanitizer: Preventing prompt injection to long-context llms via prompt sanitization,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.889944Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:2109d6e53b0b71d0d5276d5faf3726557d8bb32dfbd77b4d455e2d06b61b1b9a","observation_id":"b87c2d68-6b1a-4788-97cb-a45d674b1b06","resolution":{"observed_at":"2026-08-06T05:11:47.889944Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2507.15219","last_updated":"2025-07-21T03:41:44Z","snapshot_observed_at":"2026-08-06T15:35:31.690602Z","submitted_at":"2025-07-21T03:41:44Z","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2507.15219","snapshot_observed_at":"2026-08-06T05:11:47.970675Z","title":"Promptarmor: Simple yet effective prompt injection defenses,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.970675Z"},"links":{"cited_paper":"/paper/2507.15219","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:35bfc184da52de24da79a13214d49c5be913db2b0d86bc02edeb8b117cd81676","observation_id":"407bed97-eabb-4702-8561-0b84d15625bf","resolution":{"observed_at":"2026-08-06T05:11:47.970675Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:48.140727Z","title":"Defending against prompt injection with datafilter,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:48.140727Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:848a4b48c2cee53d9912c575d9041e524e35e48735c9af7a5e5c9673dd608b50","observation_id":"333ca45e-6c47-4e83-9f80-76610928175c","resolution":{"observed_at":"2026-08-06T05:11:48.140727Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-07T19:59:01.081751Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-06T05:11:48.276646Z","title":"Defeating prompt injections by design,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:48.276646Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:61b461749463c70a25fd000214cdb118ffa767b3bd1583318d338dedb87b4ccb","observation_id":"059b8f4f-e9f5-4311-a80e-d78b91967332","resolution":{"observed_at":"2026-08-06T05:11:48.276646Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:52.139197Z","title":"Drift: Dynamic rule-based defense with injection isolation for securing llm agents,","venue":null,"work_id":"801ebf0d-a39f-46c4-845f-3871df6f1cec","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:48.451426Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:c2c52542f23ca0876355834577315edcef0f4b8f0682ef0960c8a0ee27848dc4","observation_id":"82359524-7b03-44e3-a8b2-982d4129ad90","resolution":{"observed_at":"2026-08-06T05:11:52.260009Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2602.03117","last_updated":"2026-05-07T07:42:14Z","snapshot_observed_at":"2026-07-06T22:44:18.875334Z","submitted_at":"2026-02-03T05:20:42Z","title":"AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2602.03117","snapshot_observed_at":"2026-08-06T05:11:48.601504Z","title":"Agentdyn: A dynamic open-ended benchmark for evalu- ating prompt injection attacks of real-world agent security system,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:48.601504Z"},"links":{"cited_paper":"/paper/2602.03117","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:ac14112095e6800811d4f03484be55b56f553a2778dc8d4d5dd179a8ab511208","observation_id":"d8392da2-dc0a-404f-91c0-488d8251085d","resolution":{"observed_at":"2026-08-06T05:11:48.601504Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:51.876243Z","title":"Claude opus 4.8 system card,","venue":null,"work_id":"8426c432-a006-4a49-8ae3-9ce6ebca1b89","year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:48.792435Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:b910d3c5c2f0b58ffe008d68efd273d23cb3b8a2f362ce0197e65cac1304dd9f","observation_id":"c23152a6-c5e5-4cd2-a546-fbde8379b1b4","resolution":{"observed_at":"2026-08-06T05:11:51.990541Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:51.619734Z","title":"Secalign: Defend- ing against prompt injection with preference optimization,","venue":null,"work_id":"4a30fd48-1666-495d-954b-342c6f168108","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:48.892272Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:9c85de008b96cf0f451631e863c703deb6c30eb1c1dd7ff580d82d4042b2bf52","observation_id":"d09fb8ad-d715-4abd-8272-6f2a4d75c615","resolution":{"observed_at":"2026-08-06T05:11:51.702584Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-02T11:48:17.206729Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-08-06T05:11:48.996878Z","title":"The instruction hierarchy: Training llms to prioritize privileged instructions,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:48.996878Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:6aa20ffd2e7a0b6d04f563f65770e299193347b1a7e6bd082b27f314855345d4","observation_id":"9f07afa9-9677-4cdc-8795-3b858e9f8935","resolution":{"observed_at":"2026-08-06T05:11:48.996878Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:51.419078Z","title":null,"venue":null,"work_id":"d9f4663f-8678-4bfe-9c5e-b2b75b79e681","year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:49.034052Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:ecec201289cc6d22be7c22772ba69f49cae32efe9b8405c2be65fef06abbee8a","observation_id":"c7126831-551e-4344-84b8-ffab5e6054f3","resolution":{"observed_at":"2026-08-06T05:11:51.514757Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:51.140208Z","title":null,"venue":null,"work_id":"47cf36e1-8b4e-4df8-a32d-a583845ea509","year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:49.083594Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:0f1dcd48ce556b03dbf068357a05bd97961b68a8b24481829f114bd813bdd3ad","observation_id":"f5074bf4-fd08-4704-b766-4b57a2c2cdc8","resolution":{"observed_at":"2026-08-06T05:11:51.296756Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:50.975176Z","title":null,"venue":null,"work_id":"b957a8cb-efac-46d6-813d-f5a7bab54b77","year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:49.126679Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:3b2fe70404564f602e6b84da4b4067f69754e9179c94029620d8bf9b2879a948","observation_id":"c1fea9e2-c54c-47e1-b6a8-1f3ee21011a3","resolution":{"observed_at":"2026-08-06T05:11:51.021691Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:50.732061Z","title":null,"venue":null,"work_id":"15943586-be93-4886-b37d-613efbec3d5e","year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:49.191010Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:733b36bd36de80529ae0a3e5cff4802ec7301730e79b91b36b3a638017ce078d","observation_id":"b27962e6-48cf-4f7a-b695-dcc41b949dc2","resolution":{"observed_at":"2026-08-06T05:11:50.833130Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:50.448875Z","title":"## In-context examples","venue":null,"work_id":"c7ab87ef-9e90-4f1b-8a06-7aaeb558124f","year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:49.260862Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:b7d4506131819c9caf82e0e46e446842e3e2b148c7d823e0dd8ea742bf8cc7a2","observation_id":"dc2a7192-903f-4f9e-bae5-1e721339cad3","resolution":{"observed_at":"2026-08-06T05:11:50.559662Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:50.227444Z","title":"## When this strategy is expected to fail","venue":null,"work_id":"108187ac-b813-477d-87ec-8edf9cf1eb4d","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:49.315668Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:dd2c2dc259a55128a504f0c4f501b3d71111b028fb7c201ca11b63ab688cc88f","observation_id":"a1f25a28-a12e-4227-91e7-d3686e6a9dcf","resolution":{"observed_at":"2026-08-06T05:11:50.294110Z","resolver_source":"raw_fallback","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-09T08:47:01.328770Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming"},"reference_resolution":{"displayed":55,"state_counts":{"malformed_identifier":1,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":28,"verified_exact":0,"verified_fuzzy":26},"total_outbound_references":55},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 55 of 55 outbound references and 0 inbound Pith citation observations for arXiv:2608.05108."}