{"as_of":"2026-08-19T01:01:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:f519143c0a3a28442c366111050a877441ae5df82762ac4bde2503be830ddba8","coverage":[{"denominator":28,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":28,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-14T04:23:15.117560Z","state":"measured"},{"denominator":28,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":28,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-18T06:34:40.430872+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.08939/citation-record","integrity":"/paper/2608.08939/integrity","json":"/paper/2608.08939/citation-record.json","paper":"/paper/2608.08939"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.918204Z","title":"d.].Create an Accessibility Service","venue":null,"work_id":"a5ddc7af-d201-48bf-8bba-07737c1518e6","year":null},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:14.955778Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:f802483c2635892491b9e31a2298d8a95ed93f148fe0d350cc3237920a804ee9","observation_id":"15b34c7f-370a-4811-9055-407b2809abd9","resolution":{"observed_at":"2026-08-14T04:23:15.922131Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:14.960244Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:14.960244Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:f363c8ca7a88f240da368c954e86452a7b6f5535876397bccad09d83ea000c32","observation_id":"28b738a1-d8e5-48fa-9f83-1b55847501ed","resolution":{"observed_at":"2026-08-14T04:23:14.960244Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.906448Z","title":null,"venue":null,"work_id":"04374cfc-fc69-47e8-a80a-08cdbaf68b7f","year":null},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:14.964356Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:f949cd9f02f70ee3a981efbf3798d33c32e6eccbf96e4654e0ad8de389afd0d7","observation_id":"853cccc8-4d90-4893-b60d-01faa66785a3","resolution":{"observed_at":"2026-08-14T04:23:15.910553Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.894420Z","title":null,"venue":null,"work_id":"ab0a2a35-a210-4583-8ce2-5702ef243147","year":2024},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:14.973640Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:44e6205e3442296b573a32eb637f98e8919e2a3020b901eb1a0f5ae29d4f9dcd","observation_id":"d6fb0979-add3-4412-9220-69f22f59e604","resolution":{"observed_at":"2026-08-14T04:23:15.898685Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.27140","last_updated":"2026-07-07T02:18:26Z","snapshot_observed_at":"2026-08-15T21:43:41.146119Z","submitted_at":"2025-10-31T03:35:59Z","title":"Measuring the Security of Mobile LLM Agents under Adversarial Prompts from Untrusted Third-Party Channels","version":3},"cited_work":{"arxiv_id":"2510.27140","doi":"10.48550/arxiv.2510.27140","metadata_source":"pith","pith_arxiv_id":"2510.27140","snapshot_observed_at":"2026-08-14T06:16:15.895014Z","title":"Measuring the Security of Mobile LLM Agents under Adversarial Prompts from Untrusted Third-Party Channels","venue":"cs.CR","work_id":"df9a1243-6a13-4b15-8dc2-c38e19123945","year":2025},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:14.978764Z"},"links":{"cited_paper":"/paper/2510.27140","citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:7d0214a7b690ae88ce7c99f609e7af0d956bea02d63c29007b6f6d79518bfa1c","observation_id":"53978734-cb75-4b47-90af-920beca94fac","resolution":{"observed_at":"2026-08-14T04:23:15.520468Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:14.985094Z","title":"Roush, Judah Goldfeder, and Ravid Shwartz-Ziv","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:14.985094Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:f9304ee2f1c21867987f4e1682dc671f1d906608654a2aeb9d54507fe769eda1","observation_id":"f4c0c169-6695-4da7-83fb-ed5670ae53bd","resolution":{"observed_at":"2026-08-14T04:23:14.985094Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:14.990283Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:14.990283Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:656c9ca3082872f317edd121dcdadfc784b8f67502f0374426235843fd649df4","observation_id":"f2214a97-ce33-47eb-a1fb-dc2363de597f","resolution":{"observed_at":"2026-08-14T04:23:14.990283Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.879886Z","title":null,"venue":null,"work_id":"4b468029-e68b-43a2-bd63-9315df0e4618","year":2021},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:14.994599Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:69af51c26ca8424ca93aaf98dc59882d5f30b13e8c44a6ac679943907f27a64a","observation_id":"db784329-50fd-467a-86b2-c9dee847e31e","resolution":{"observed_at":"2026-08-14T04:23:15.885199Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:14.998345Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:14.998345Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:927fe8f6e552df1be9eb3addf6b5765fe493ee2cb63a039ff4ecb87b85abacfd","observation_id":"08254851-edcd-4a87-a354-4fb40767f96b","resolution":{"observed_at":"2026-08-14T04:23:14.998345Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2601.19306","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.687463Z","title":null,"venue":null,"work_id":"01716d2c-66e2-482e-a875-69172085fbd8","year":2026},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.002718Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:272da5806f2afc77aa635915e1f59bee150e4a6fac92ac503a6aff8ec539448c","observation_id":"795c775b-eba5-433c-949e-c3d986b4bfb9","resolution":{"observed_at":"2026-08-14T04:23:15.694097Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.021438Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.021438Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:413ad46aeb4c346bff9b050cf6080d45b1c68dcc5af950a24d9bd074c063ac91","observation_id":"2d7dc466-6842-4e8f-bfd6-d7fac843c233","resolution":{"observed_at":"2026-08-14T04:23:15.021438Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-19T00:43:34.703842Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-14T04:23:15.028834Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.028834Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:79588b4e2007d3bdd004057936aaf68a7b268a4b4d8b7baffc0ef594e64175f5","observation_id":"54992195-e40d-41b8-bca5-1cc9f50365a6","resolution":{"observed_at":"2026-08-14T04:23:15.028834Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.034663Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.034663Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:7d3277aa145bdb0ad4913b01d68b76d25a9e90345693694fad8dcb0afdf4942a","observation_id":"5743538c-27ae-4719-a5ae-17c3ece7a404","resolution":{"observed_at":"2026-08-14T04:23:15.034663Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.866873Z","title":"2026.App Cards Feature Documentation","venue":null,"work_id":"e8e4e58f-f398-4b94-a57f-4d9ace0cfcd5","year":2026},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.040370Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:a3570974c9c77d568d363b2c3ca8863c4496035f60600f81994aca9a62cb96e4","observation_id":"5ddecaba-e93e-45c2-8b5b-649d5e7445f1","resolution":{"observed_at":"2026-08-14T04:23:15.871436Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.854418Z","title":null,"venue":null,"work_id":"b3eccf0a-c001-43ac-90a6-a38c43e2cc88","year":2026},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.044357Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:da6a9cda5537a364324e0042e24c3e3e2fc1d11b2f65fe7bf18703ee49e819b2","observation_id":"6454b155-3bfd-42e2-a4e9-197b62119f8e","resolution":{"observed_at":"2026-08-14T04:23:15.858429Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2211.09527","last_updated":"2022-11-17T13:43:20Z","snapshot_observed_at":"2026-08-18T00:11:55.170013Z","submitted_at":"2022-11-17T13:43:20Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2211.09527","snapshot_observed_at":"2026-08-14T04:23:15.049508Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.049508Z"},"links":{"cited_paper":"/paper/2211.09527","citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:547146c91be8cf7a60b808dc2c8ac0e8b891f9f09063fb9681a9b2eea0033505","observation_id":"428f7bf9-0d71-44af-845b-a28f040fd237","resolution":{"observed_at":"2026-08-14T04:23:15.049508Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.14573","last_updated":"2025-04-06T20:37:50Z","snapshot_observed_at":"2026-08-18T16:24:19.448563Z","submitted_at":"2024-05-23T13:48:54Z","title":"AndroidWorld: A Dynamic Benchmarking Environment for Autonomous Agents","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.14573","snapshot_observed_at":"2026-08-14T04:23:15.054921Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.054921Z"},"links":{"cited_paper":"/paper/2405.14573","citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:d5417bb0ce4f67e64b1d90d98840476fa9c576a808d14af2b277609590af347c","observation_id":"b50538ce-10a3-4983-ab6f-b5dee63ddee9","resolution":{"observed_at":"2026-08-14T04:23:15.054921Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2607.02770","last_updated":"2026-07-02T21:08:53Z","snapshot_observed_at":"2026-08-18T16:22:37.329414Z","submitted_at":"2026-07-02T21:08:53Z","title":"Gemma 4 Technical Report","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2607.02770","snapshot_observed_at":"2026-08-14T04:23:15.060376Z","title":"2026.Gemma 4 Technical Report","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.060376Z"},"links":{"cited_paper":"/paper/2607.02770","citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:a5c9dde11ee14b4b3a90b8ab6a71781bed47ea174e6e2f2aaf35e28a46f54964","observation_id":"5b1b35a1-afe4-4526-a6bc-a494319bcfc8","resolution":{"observed_at":"2026-08-14T04:23:15.060376Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.843152Z","title":"2026.Qwen Studio","venue":null,"work_id":"8ea95c53-e0e8-479b-a06f-96c465f2e716","year":2026},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.065321Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:835f334a45f0b3f23ce788bafd869d4e927100eaac7ed202d10cca8364d0989c","observation_id":"b21b94d0-96fd-40c6-a878-958b31e2928e","resolution":{"observed_at":"2026-08-14T04:23:15.846832Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.831631Z","title":null,"venue":null,"work_id":"d6752839-1168-4e81-bffb-8730078296b7","year":2024},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.070424Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:c33330ff2b31439916998759400c4f0c816d0f3512bd806828b469d452a1ae93","observation_id":"eeebed71-d21a-4e4d-ba0a-6b96f252ee3f","resolution":{"observed_at":"2026-08-14T04:23:15.835430Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2401.16158","last_updated":"2024-04-18T06:53:38Z","snapshot_observed_at":"2026-08-16T13:42:20.592010Z","submitted_at":"2024-01-29T13:46:37Z","title":"Mobile-Agent: Autonomous Multi-Modal Mobile Device Agent with Visual Perception","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.16158","snapshot_observed_at":"2026-08-14T04:23:15.076505Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.076505Z"},"links":{"cited_paper":"/paper/2401.16158","citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:7e9f5438e1576b4cbf708c759df4104956953cb5640102a075b88fb3c77f872c","observation_id":"d49ee131-ac9b-41c6-8ad1-890747ca746f","resolution":{"observed_at":"2026-08-14T04:23:15.076505Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.819603Z","title":null,"venue":null,"work_id":"25095231-46c6-49f2-9a11-d23ad3fd0098","year":2024},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.082141Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:1ea0f825367e22c691f4e28277c419873bcaeb40d5122cbd3f079670afc0a7a6","observation_id":"7b5c189b-9ec8-4004-86b6-ea382af66ede","resolution":{"observed_at":"2026-08-14T04:23:15.823957Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.806329Z","title":null,"venue":null,"work_id":"81ea2b8d-73ca-4e41-a3a9-e59f6a62e617","year":2024},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.091834Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:9168b9cf3a3be5c0755ba324fd46db79c3d837cde229a83021f644e8acd9974a","observation_id":"6f5e6447-fe81-456e-886f-cc2ab526079d","resolution":{"observed_at":"2026-08-14T04:23:15.810119Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.13771","last_updated":"2026-07-05T07:51:04Z","snapshot_observed_at":"2026-08-16T14:32:38.574557Z","submitted_at":"2023-12-21T11:52:45Z","title":"AppAgent: Multimodal Agents as Smartphone Users","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.13771","snapshot_observed_at":"2026-08-14T04:23:15.098579Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.098579Z"},"links":{"cited_paper":"/paper/2312.13771","citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:426792b1dcc8c40cf971fac1fb2a77ed70d802242450d7111e1f2a560988cd51","observation_id":"6abd1676-9430-43cc-9dee-b6bf4097b977","resolution":{"observed_at":"2026-08-14T04:23:15.098579Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.48550/arxiv.2410.17520","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.312195Z","title":null,"venue":null,"work_id":"1f946d25-e7d9-412e-b620-372ef4db4176","year":2024},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.105070Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:d47a5da25c09bf0f81c1d8f29d837155fcd64797a9425cc9a06d565d3ff2acad","observation_id":"01495d6d-056b-4ac5-b6f5-c5f1f1dbc8d6","resolution":{"observed_at":"2026-08-14T04:23:15.317068Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2607.00333","last_updated":"2026-07-14T03:01:43Z","snapshot_observed_at":"2026-08-12T11:33:56.944758Z","submitted_at":"2026-07-01T02:17:19Z","title":"(A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents","version":2},"cited_work":{"arxiv_id":"2607.00333","doi":"10.48550/arxiv.2607.00333","metadata_source":"pith","pith_arxiv_id":"2607.00333","snapshot_observed_at":"2026-08-14T06:16:15.895014Z","title":"(A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents","venue":"cs.CR","work_id":"6b50b7ec-6b4c-49ab-9060-de6b20f81eaa","year":2026},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.111050Z"},"links":{"cited_paper":"/paper/2607.00333","citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:319f1cb473b03da63716dde5e9afdd5f7ded2d3cbffa0bdacd313411b243dc40","observation_id":"adebfe8e-1dcf-4961-92da-d4fd3645920d","resolution":{"observed_at":"2026-08-14T04:23:15.256242Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.48550/arxiv.2602.10915","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-14T04:23:15.231441Z","title":"testtag","venue":null,"work_id":"ee57716c-1039-4120-a623-159feb31c4f9","year":2026},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.117560Z"},"links":{"citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:8f4d0e45aca60d4517ffe770ed15ad73e88916b328b81c2c96f30e07957e6450","observation_id":"5063c1b9-70ed-4fa5-90e0-90b50b6ffa11","resolution":{"observed_at":"2026-08-14T04:23:15.236474Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-17T17:40:10.591866Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-14T04:23:14.968841Z","title":"doi:10.48550/arXiv.2503.18813","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":2025,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:14.968841Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:2296af2d2e9aa5fc1c1c45af4b4ca1bc95f64cd312bb5fd8ad46af6003149b03","observation_id":"a1b29b8d-06da-4521-b774-cf41a577b432","resolution":{"observed_at":"2026-08-14T04:23:14.968841Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","latest_version":1,"primary_category":"cs.AI","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection"},"reference_resolution":{"displayed":28,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":20,"verified_exact":5,"verified_fuzzy":3},"total_outbound_references":28},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"thesis":"As of 19 August 2026, this Paper Citation Record lists 28 of 28 outbound references and 0 inbound Pith citation observations for arXiv:2608.08939."}