{"as_of":"2026-08-15T09:17:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:7f270eb051edb4730a4d6770ff56e413b8c706197a084c32471117e1cf722ff2","coverage":[{"denominator":51,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":51,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-12T00:27:41.904757Z","state":"measured"},{"denominator":51,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":51,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-15T06:32:42.880941+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.08131/citation-record","integrity":"/paper/2608.08131/integrity","json":"/paper/2608.08131/citation-record.json","paper":"/paper/2608.08131"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2401.05566","last_updated":"2024-01-17T20:26:01Z","snapshot_observed_at":"2026-08-14T17:02:04.115726Z","submitted_at":"2024-01-10T22:14:35Z","title":"Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.05566","snapshot_observed_at":"2026-08-12T00:27:39.724833Z","title":"Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:39.724833Z"},"links":{"cited_paper":"/paper/2401.05566","citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:5019c66a4a94e143ec35274e33e8b04ff54329b1746fcc57666f95ead7d3b49c","observation_id":"9b442563-4922-47c9-85cc-b4c8858ed49e","resolution":{"observed_at":"2026-08-12T00:27:39.724833Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:39.755114Z","title":"Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:39.755114Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:755defe4d3db903a156ee00c2e00427b18ec4cd0884ce1e22107f17cdc35f2c0","observation_id":"309e5243-f2cf-4c56-9691-9e60d0382dfd","resolution":{"observed_at":"2026-08-12T00:27:39.755114Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:39.796017Z","title":"BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:39.796017Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:d7c75345551379805a331e58d5585568c308de9d19308a3f4affa9b2327c335e","observation_id":"956ce005-9583-4196-a8d1-79c6a4d7b282","resolution":{"observed_at":"2026-08-12T00:27:39.796017Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:48.624876Z","title":"AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases,","venue":null,"work_id":"65cf62a3-16ec-4235-9896-5b9d4f253746","year":2024},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:39.846497Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:3a780fb3e16b4445de445040294a299819b01fa691a85ab1790bed60392c6e46","observation_id":"c2e9abdf-113b-4826-89be-c03f17de142f","resolution":{"observed_at":"2026-08-12T00:27:48.674850Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:39.885649Z","title":"MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:39.885649Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:524e5d252c8da1ad1f86f132d7459ed21f21dbf0500042fce093460364821050","observation_id":"9dc28dc3-f513-470d-8c30-27ff1fdfcfe4","resolution":{"observed_at":"2026-08-12T00:27:39.885649Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.26154","last_updated":"2026-05-24T04:26:13Z","snapshot_observed_at":"2026-08-13T17:06:22.899862Z","submitted_at":"2026-05-24T04:26:13Z","title":"MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.26154","snapshot_observed_at":"2026-08-12T00:27:39.928535Z","title":"MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:39.928535Z"},"links":{"cited_paper":"/paper/2605.26154","citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:fbbea246e0af62305ae874dd62d570c82bef879c5b15d5d3cfef1a480e29af4d","observation_id":"02791b60-b0b8-4fb7-ab4d-e39b756280c3","resolution":{"observed_at":"2026-08-12T00:27:39.928535Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:48.481765Z","title":"Your LLM Agent Can Leak Your Data: Data Exfiltration via Backdoored Tool Use,","venue":null,"work_id":"3d0157fc-251c-40da-8205-b24d17c30ae6","year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:39.975715Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:c4bda9c1bd186086b892edaaba6a7f32e0216abb5cc30deff75f457f89d822e0","observation_id":"41fdd77f-ba8c-4212-8d29-5b27157f952e","resolution":{"observed_at":"2026-08-12T00:27:48.524756Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:40.044762Z","title":"TrojanStego: Your Language Model Can Secretly Be A Steganographic Privacy Leaking Agent,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.044762Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:a85a1faa7a25477886ce46a455cdc5d9d486b2b8e1f1a8c042f3dbfd54cdfe5c","observation_id":"863a6853-327a-4029-befe-468aefb5cf7e","resolution":{"observed_at":"2026-08-12T00:27:40.044762Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:48.320941Z","title":"BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models,","venue":null,"work_id":"5c4c05d8-17de-4b91-8e34-0259cdf952a7","year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.080853Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:adf722ca75d841d346289767b9c8dbd4484997502b31b6bf22a425c3759c99a0","observation_id":"c8d20b37-935f-480c-aac7-04448fb7bdf1","resolution":{"observed_at":"2026-08-12T00:27:48.354775Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:40.119007Z","title":"Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.119007Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:0fd74e31485e90b4e39435beff0006775586445a02ef1fa4dbc61381804fece4","observation_id":"d0603caf-fb05-4bc1-969b-7889702e85ce","resolution":{"observed_at":"2026-08-12T00:27:40.119007Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-12T00:27:40.164821Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.164821Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:c6cd5c26a4b8804391984af0cab4ba65c4c79a9192762b8e4255044ae72ea4a9","observation_id":"b8f36127-fa5a-4672-aba4-460fd160a830","resolution":{"observed_at":"2026-08-12T00:27:40.164821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:48.184752Z","title":"The UNSTOPPABLE Computer Virus is HERE...,","venue":null,"work_id":"bb9c53d6-802b-421a-9238-1df5a134a373","year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.214847Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:8f402f6c47589186727fe0f09c2a84d30d421560f921cf7ca0d60aa27a0e3c97","observation_id":"90e09d21-ab08-4f6f-bdc5-07fb1cc706b1","resolution":{"observed_at":"2026-08-12T00:27:48.223407Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:48.108696Z","title":"Inhibitor Chip,","venue":null,"work_id":"75b8b360-2f33-47c6-b603-5bb840f35e1a","year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.254823Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:d7c4923e2f6d52eb73336acf4e25b4971738c8b8c3cbf0d5f29597115ead5688","observation_id":"28cf8109-f145-4469-93e5-b9c6cc521c6f","resolution":{"observed_at":"2026-08-12T00:27:48.135312Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02817","last_updated":"2025-01-30T11:11:37Z","snapshot_observed_at":"2026-08-13T04:03:13.579574Z","submitted_at":"2024-03-05T09:37:13Z","title":"Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.02817","snapshot_observed_at":"2026-08-12T00:27:40.294752Z","title":"Here Comes the AI Worm: Preventing the Propagation of Adversarial Self-Replicating Prompts Within GenAI Ecosystems,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.294752Z"},"links":{"cited_paper":"/paper/2403.02817","citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:52ffbef329b5aca4e6256bae1c06004338d36337e3febb01581bb2f792c5f5df","observation_id":"5545133a-5795-413f-89f0-c74741f32cce","resolution":{"observed_at":"2026-08-12T00:27:40.294752Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2603.15727","last_updated":"2026-07-16T04:17:50Z","snapshot_observed_at":"2026-08-15T04:16:52.708775Z","submitted_at":"2026-03-16T17:55:43Z","title":"AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2603.15727","snapshot_observed_at":"2026-08-12T00:27:40.330332Z","title":"AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.330332Z"},"links":{"cited_paper":"/paper/2603.15727","citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:36aabab9c982ef35cdd811ef9ca61f9f32d092c1630eba29bab67d4c36917b5a","observation_id":"28840d74-d48d-450b-82b2-9c346948f179","resolution":{"observed_at":"2026-08-12T00:27:40.330332Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:48.001144Z","title":"Agent Harness Plugins,","venue":null,"work_id":"143ad2c5-8778-45ff-b82a-a7ff2ee3d37f","year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.364899Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:f8527349e81b49b05f88bbf79ec9695e9a95a39b33a78e0cc4dfde1a41159977","observation_id":"4eaffcdb-2844-426b-8fa3-1d5e56c9b88c","resolution":{"observed_at":"2026-08-12T00:27:48.037153Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:47.854795Z","title":"Sandboxing,","venue":null,"work_id":"ad4e8bd0-94bb-4640-a150-af72d122399e","year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.415447Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:b890f96e54a2f11cd8ab7f04e89d3c3770290de4d03cdd9acb1cba5935ec46a7","observation_id":"56dbd000-8080-4d1a-9661-08e9fd42b32b","resolution":{"observed_at":"2026-08-12T00:27:47.895176Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2606.03811","last_updated":"2026-06-02T15:54:39Z","snapshot_observed_at":"2026-08-08T01:13:52.829970Z","submitted_at":"2026-06-02T15:54:39Z","title":"AI Agents Enable Adaptive Computer Worms","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2606.03811","snapshot_observed_at":"2026-08-12T00:27:40.475237Z","title":"AI Agents Enable Adaptive Computer Worms,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.475237Z"},"links":{"cited_paper":"/paper/2606.03811","citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:06a1747019de05d7a7b0a976cad0ccdd1c5bb36398be6fca08ec79143b7d3208","observation_id":"f08083ad-512a-4fea-849c-1f0fcac7ae78","resolution":{"observed_at":"2026-08-12T00:27:40.475237Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:47.708312Z","title":null,"venue":null,"work_id":"72fc032e-5432-4b7a-9fcf-ead76d3f10aa","year":1972},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.523864Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:18b8f1e3f26cf19682bb0ab5f9778a5a4e866c7e27fba9b183e4358440d54684","observation_id":"6c56bdc4-213e-4f59-9a2b-b4bc8351a96b","resolution":{"observed_at":"2026-08-12T00:27:47.744850Z","resolver_source":"raw_fallback","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2602.06547","last_updated":"2026-06-10T03:31:37Z","snapshot_observed_at":"2026-08-14T07:49:09.150281Z","submitted_at":"2026-02-06T09:52:27Z","title":"\"Do Not Mention This to the User\": Detecting and Understanding Malicious Agent Skills in the Wild","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2602.06547","snapshot_observed_at":"2026-08-12T00:27:40.575004Z","title":"Do Not Mention This to the User","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.575004Z"},"links":{"cited_paper":"/paper/2602.06547","citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:9917cde53422f7d4802b9586202180eacd8b5111b33dfdd5a2cadd1453681f21","observation_id":"7e82f5d8-4a84-4efe-bcbf-ebe065d46d41","resolution":{"observed_at":"2026-08-12T00:27:40.575004Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:40.597003Z","title":"The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multistep Malware Delivery Mechanism,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.597003Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:c51a5c547fec61548a11eab96b8b4b105882046c39e301ed89368941539b3b9f","observation_id":"2003454a-7efe-4ef3-8e63-347f64e90bb7","resolution":{"observed_at":"2026-08-12T00:27:40.597003Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:40.644753Z","title":"The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.644753Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:c1f7d169c7be2028785f887f055d1f45b0a0abc956e24e91c35b4acb6be01462","observation_id":"19e34c6d-af88-4013-ac20-e54116b07705","resolution":{"observed_at":"2026-08-12T00:27:40.644753Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:47.534614Z","title":null,"venue":null,"work_id":"6460e7e6-e1ee-47bb-8024-4a6a36cbda92","year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.684756Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:ac0baca77605df67195771dcb616bb9c4b11ebbe54c05ef28c29d85e2eb9a5ae","observation_id":"0d6a537f-752f-4b1f-820e-cd9af7f1dfb4","resolution":{"observed_at":"2026-08-12T00:27:47.582954Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:47.394752Z","title":"Data Scientists Targeted by Malicious Hugging Face ML Models with Silent Backdoor,","venue":null,"work_id":"df00633f-50bd-4de0-93d1-6a4ab1a120d6","year":2024},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.734754Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:619dfbdd45887dc3684da218e5f9a1797b8f287e0391fb4d4ac26a0c5ad8c147","observation_id":"4d6b4293-8dd0-4f9f-9f70-1d5c1573410b","resolution":{"observed_at":"2026-08-12T00:27:47.433652Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:47.244752Z","title":"Malicious ML Models Discovered on Hugging Face Platform,","venue":null,"work_id":"73ad8508-04d7-4da0-b829-27a342556867","year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.765430Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:a501e38f71a6dce6d1102ded452f2abce5cd1a586ff79e92c5f4b6b515936ae3","observation_id":"82a30afb-a12e-442f-ae1d-9ad47e106730","resolution":{"observed_at":"2026-08-12T00:27:47.287910Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:40.816629Z","title":"Vassilev, A","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.816629Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:4854417929929ec590f218a5b000b2a8e67738e0647b6c1dd9c64f54c0a5950e","observation_id":"36629ec0-20e0-47c0-9741-962c43c5f3cd","resolution":{"observed_at":"2026-08-12T00:27:40.816629Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:47.074827Z","title":"OpenAI and Hugging Face Partner to Address Security Incident During Model Evaluation,","venue":null,"work_id":"fdf0900d-04aa-4f65-a00c-6990ae09c05f","year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.865377Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:a45f7e80e6eea75afc1922d375c6f42d2c1f616a393aadbd86b074d0f7ddd5f2","observation_id":"61973191-b00b-4015-97bc-139ac8f0acb1","resolution":{"observed_at":"2026-08-12T00:27:47.124754Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:46.914865Z","title":"Third-Party Cyber Evaluations Involving OpenAI Models,","venue":null,"work_id":"e98cc3cc-8f41-4109-8acb-121a9e6f393d","year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.904977Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:4929ee9dbde83b22bb266489fd6f8d01079af4ffa725be9bae1c1660165fdf6e","observation_id":"e055b162-a25d-45f2-a4b9-830aa4120bc4","resolution":{"observed_at":"2026-08-12T00:27:46.960857Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:46.819815Z","title":"Security Incident Disclosure—July 2026,","venue":null,"work_id":"7a3e7257-ac39-4e5d-b4ca-5bc3bafe7449","year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.945053Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:ca819833ec3839057fb4647496e30c3720d039dc195e5ec464f7f951c30974af","observation_id":"c788fb0b-dc77-430c-80c3-009f7d47f6b1","resolution":{"observed_at":"2026-08-12T00:27:46.836194Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:46.761841Z","title":"Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident,","venue":null,"work_id":"929e334b-a875-4562-9d54-fe7aedd1ad8d","year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:40.983158Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:0828107cd84272200a252e0f09a1e3618237879015b313ab2b9a61200ab695a9","observation_id":"f4312c69-80d4-4956-9d95-51246b8ea4b5","resolution":{"observed_at":"2026-08-12T00:27:46.777605Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:46.631668Z","title":"Investigating Three Real-World Incidents in Our Cybersecurity Evaluations,","venue":null,"work_id":"66ed8996-5e08-4749-b8ed-18102f283ac9","year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.024857Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:742b3a664f19ddb388d75096a71b822559bf8ba91b56571bc2dc68f5475adbde","observation_id":"aa867b46-3ae5-4694-a18a-155bf11a5e6a","resolution":{"observed_at":"2026-08-12T00:27:46.694829Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:46.535018Z","title":"CVE-2025-32711 Detail,","venue":null,"work_id":"11e21d89-159f-43d5-953b-08aefdba06e4","year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.078459Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:b597736377e026bbbad8fbf3e56732701efa0d83d3842c9c513a458b1f36107b","observation_id":"9f1afd4d-e07f-4588-bac1-3404a195b73a","resolution":{"observed_at":"2026-08-12T00:27:46.558954Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:46.409646Z","title":"CVE-2025-32711: AI Command Injection in M365 Copilot,","venue":null,"work_id":"65554a6d-f9b4-48d3-9ccc-9f6c6258bd60","year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.098637Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:b7fa0cdd9bf8de3ab56eaa15aad72334f0a4635d52b4d26b84ada38d38fbecb8","observation_id":"9388d3cc-4e1f-4e0c-bcda-c6099742e650","resolution":{"observed_at":"2026-08-12T00:27:46.423653Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:46.314900Z","title":"Microsoft 365 Copilot: New Zero-Click AI Vulnerability Allows Corporate Data Theft,","venue":null,"work_id":"a222d094-af91-48c1-a4ac-325778d6b012","year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.144750Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:04bc25c4a4b11e2cfe336de5aead040e3d63121eca98f69869e872f49f16da70","observation_id":"db074430-105e-4bec-b1c9-00adb4c43d7f","resolution":{"observed_at":"2026-08-12T00:27:46.364752Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:46.147266Z","title":"ShadowLeak: A Zero-Click, Service-Side Attack Exfiltrating Sensitive Data Using ChatGPT’s Deep Research Agent,","venue":null,"work_id":"d045feae-f4df-4df9-9fbf-64707138f3f8","year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.164751Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:873bba938bfc6fba92f2303da6b75b2ade3989adab213f703d2259a5d0590d35","observation_id":"63282f5e-41cd-41f0-be87-99ca0a7db54c","resolution":{"observed_at":"2026-08-12T00:27:46.194755Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:46.064756Z","title":"MCP Security Notification: Tool Poisoning Attacks,","venue":null,"work_id":"779e61ef-4b0d-463d-aa22-765902628933","year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.204756Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:d6ff872c8428197ce1cb7d6a4363e33d7ea12e20042eb3da296301b84c32d391","observation_id":"275b5edd-67ca-48af-8abb-07aa01d72b09","resolution":{"observed_at":"2026-08-12T00:27:46.104833Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:41.244758Z","title":"Memory Injection Attacks on LLM Agents via Query-Only Interaction,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.244758Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:c8fc6f73b639898feb7b317b15b6a26781addc24d9cd553f6c933cebfcf821b7","observation_id":"2c918cec-6937-4f0f-9753-7749515e1915","resolution":{"observed_at":"2026-08-12T00:27:41.244758Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.15338","last_updated":"2026-05-18T07:05:25Z","snapshot_observed_at":"2026-08-14T01:42:26.007821Z","submitted_at":"2026-05-14T19:06:10Z","title":"Hidden in Memory: Sleeper Memory Poisoning in LLM Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.15338","snapshot_observed_at":"2026-08-12T00:27:41.285934Z","title":"Hidden in Memory: Sleeper Memory Poisoning in LLM Agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.285934Z"},"links":{"cited_paper":"/paper/2605.15338","citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:b150bf3a7ac32173ecda03d9fd847b14ca66d30197b4124b0cdd592a63aac063","observation_id":"9d260514-6c10-4e62-a59f-3dc253b05baf","resolution":{"observed_at":"2026-08-12T00:27:41.285934Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2606.04329","last_updated":"2026-06-18T22:06:23Z","snapshot_observed_at":"2026-08-04T07:47:41.111384Z","submitted_at":"2026-06-03T01:04:13Z","title":"From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2606.04329","snapshot_observed_at":"2026-08-12T00:27:41.324755Z","title":"From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.324755Z"},"links":{"cited_paper":"/paper/2606.04329","citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:053465e3ebbe67de1343ba9cdc023f064f0d68e5291933e26154fd9487e3944a","observation_id":"ece7a236-3d8c-492c-93d0-0049317b5277","resolution":{"observed_at":"2026-08-12T00:27:41.324755Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:45.914752Z","title":"Malicious Script Injected into Amazon Q Developer for Visual Studio Code Extension,","venue":null,"work_id":"c2e23f5c-8bfd-43d3-a0ca-cd239b2eb41e","year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.364751Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:f33f3f575dd433dec0322d1f1e0edf3812ccbfe2fecb7e2792b9ff373afb13b4","observation_id":"72c09d27-fabc-483a-99d9-d59ee8df0cdb","resolution":{"observed_at":"2026-08-12T00:27:45.964752Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:45.745629Z","title":"The Shai-Hulud 2.0 npm Worm: Analysis, and What You Need to Know,","venue":null,"work_id":"fabf474e-ad03-483c-900a-cd7745fbe582","year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.413633Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:b220b5bda592597e87866eaf29a4aded74923982f7cc4b3b037f55725d8607a8","observation_id":"206df232-0946-48f4-9c81-a7f626d399b0","resolution":{"observed_at":"2026-08-12T00:27:45.774752Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:45.710835Z","title":"Mini Shai-Hulud Targets AI Coding Agents: What Developers Need to Know,","venue":null,"work_id":"ab9dbeff-2ef2-47b7-8c2c-38a086283867","year":2026},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.464750Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:6b96e5cec1fa7cdc4ec3e92fa07081c5fee4648a2d8f5b8edf76e09d8cb5593e","observation_id":"16557417-335a-49e2-91ed-a3b236408ba3","resolution":{"observed_at":"2026-08-12T00:27:45.718381Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:45.651058Z","title":"Malicious Versions of Nx and Some Supporting Plugins Were Published,","venue":null,"work_id":"6f3ea095-4a1c-452d-8725-bcbd53eab0e9","year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.511313Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:0db9e7ddb08efc2a50255825b73c219d3d66f48370d13a5af61baba74deab0f7","observation_id":"8d95a65c-3bfe-4bd2-80a0-d4b02a192e85","resolution":{"observed_at":"2026-08-12T00:27:45.658413Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:45.574754Z","title":"S1ngularity—What Happened, How We Responded, What We Learned,","venue":null,"work_id":"d1d929f7-4bda-42a2-97c4-b2d11f7e9d97","year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.564749Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:b128726d9b4e0b754e999f51cb7ae515a51505c452e0b216264529deab24449f","observation_id":"be436981-7b99-4150-9824-21f084263a47","resolution":{"observed_at":"2026-08-12T00:27:45.611636Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:45.404852Z","title":"s1ngularity’s Aftermath: AI, TTPs, and Impact in the Nx Supply Chain Attack,","venue":null,"work_id":"8971b10e-f172-437f-9b0e-58422954f82c","year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.614755Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:029d84813a6876c438ed952120a3724a296ac0fab640833063b063e444fa27ff","observation_id":"3118362f-c399-4125-9f87-1379f6c537d1","resolution":{"observed_at":"2026-08-12T00:27:45.454870Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.09023","last_updated":"2025-10-10T05:51:04Z","snapshot_observed_at":"2026-08-15T07:47:42.680001Z","submitted_at":"2025-10-10T05:51:04Z","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2510.09023","snapshot_observed_at":"2026-08-12T00:27:41.664753Z","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.664753Z"},"links":{"cited_paper":"/paper/2510.09023","citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:d8e7b5b44b0ae061bc7865b0c9eb89e597cbf695fb8447ca5aba35b9e3f4c8e8","observation_id":"6965fcf9-ccdd-4b94-8957-ee503a9a4319","resolution":{"observed_at":"2026-08-12T00:27:41.664753Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-13T15:19:02.871791Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-12T00:27:41.714833Z","title":"Defeating Prompt Injections by Design,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.714833Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:7c5cf01a6275cce20ea4bb3d9a9dbf3d6d35c7c30194300061c5212de4c3a2f7","observation_id":"45473cc3-8b2c-48a0-aade-579c56545a91","resolution":{"observed_at":"2026-08-12T00:27:41.714833Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.11703","last_updated":"2026-05-14T02:36:38Z","snapshot_observed_at":"2026-08-12T23:26:44.716922Z","submitted_at":"2025-04-16T01:58:40Z","title":"Progent: Securing AI Agents with Privilege Control","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.11703","snapshot_observed_at":"2026-08-12T00:27:41.761861Z","title":"Progent: Securing AI Agents with Privilege Control,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.761861Z"},"links":{"cited_paper":"/paper/2504.11703","citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:7507a71e7948a7d5ea03b86e342cf2357fe579c314db183c15a73605f0735f6d","observation_id":"aafcb72c-b0e1-4e7e-8b3c-d1338d5b885a","resolution":{"observed_at":"2026-08-12T00:27:41.761861Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:45.256076Z","title":"SimpleProbesCanCatchSleeperAgents,","venue":null,"work_id":"a70bbc66-b00f-45e1-8cd0-247407fe898d","year":null},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.805242Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:7e07f23ef5856113b2442827e7042f7af42f35f53c69e5710f7bf38958e9ed49","observation_id":"c4b0cd2a-7794-4d12-9b9e-0bca5f34dd36","resolution":{"observed_at":"2026-08-12T00:27:45.293751Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.15549","last_updated":"2025-07-29T09:37:22Z","snapshot_observed_at":"2026-08-13T08:22:02.023626Z","submitted_at":"2024-07-22T11:19:14Z","title":"Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.15549","snapshot_observed_at":"2026-08-12T00:27:41.854957Z","title":"Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.854957Z"},"links":{"cited_paper":"/paper/2407.15549","citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:a317a82c1e42bdacb2a7c4db7992ce1bb6bea345aefadbbd813bacb2b4e385ae","observation_id":"d6d80a9c-2279-4710-a40c-5e22bea4761c","resolution":{"observed_at":"2026-08-12T00:27:41.854957Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:27:45.151752Z","title":"Agentic Misalignment: How LLMs Could Be Insider Threats,","venue":null,"work_id":"438037b2-c8d2-47f8-b7bf-7615b60af4fe","year":2025},"citing_paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-12T00:27:41.904757Z"},"links":{"citing_paper":"/paper/2608.08131"},"observation_digest":"sha256:66e216a4bbb78094349788c722e25da59dd33dd135975b55bcea2ac564e9d56a","observation_id":"2bba3fb2-0c36-4420-8b6b-f06ebde0f077","resolution":{"observed_at":"2026-08-12T00:27:45.179187Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2608.08131","last_updated":"2026-08-08T13:35:35Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-14T06:28:30.085063Z","submitted_at":"2026-08-08T13:35:35Z","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario"},"reference_resolution":{"displayed":51,"state_counts":{"malformed_identifier":2,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":22,"verified_exact":0,"verified_fuzzy":27},"total_outbound_references":51},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"thesis":"As of 15 August 2026, this Paper Citation Record lists 51 of 51 outbound references and 0 inbound Pith citation observations for arXiv:2608.08131."}