{"as_of":"2026-08-18T08:14:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:a006c243f18d8adc986f8fb0a84c6d97c2a28b2d20d80c48f2e5d68767c43ba4","coverage":[{"denominator":77,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":77,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-16T00:16:52.653903Z","state":"measured"},{"denominator":77,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":77,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-18T06:34:40.430872+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.12172/citation-record","integrity":"/paper/2608.12172/integrity","json":"/paper/2608.12172/citation-record.json","paper":"/paper/2608.12172"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2506.01055","last_updated":"2025-06-01T15:48:06Z","snapshot_observed_at":"2026-08-15T10:52:39.381322Z","submitted_at":"2025-06-01T15:48:06Z","title":"Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.01055","snapshot_observed_at":"2026-08-16T00:16:52.303564Z","title":"Simple prompt injection attacks can leak personal data observed by llm agents during task execution.arXiv preprint arXiv:2506.01055, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.303564Z"},"links":{"cited_paper":"/paper/2506.01055","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:24fdd0a6cf6dcad1d68aaaf5152ff597686bf1a847f2b26bb101bc6de6f21bf1","observation_id":"307f55f9-9df6-44ed-9392-4dd75055892e","resolution":{"observed_at":"2026-08-16T00:16:52.303564Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.133612Z","title":"Model context protocol","venue":null,"work_id":"94bf5e0f-d62e-447e-b59f-3871fa743051","year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.309227Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:16cf38a322d37caf2ed99ef13ffc1a765a9abd4c8d10cefca51c4ec7cd36c025","observation_id":"75af99fd-35b9-45be-bb0e-539c3b19fb0a","resolution":{"observed_at":"2026-08-16T00:16:54.138420Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.118625Z","title":"Air- GapAgent: Protecting privacy-conscious conversational agents","venue":null,"work_id":"97069d2a-6977-4be2-aa75-7f5cb07b87c4","year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.313941Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:d2fef27aa9748fa416a7153577f5601a5f40bfc9c933bb3fe86f7fff779bddd4","observation_id":"7bc4a230-bca9-4d4e-90b1-0e0bda6b742d","resolution":{"observed_at":"2026-08-16T00:16:54.123389Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.093730Z","title":"Off by default! InProceedings of the 4th ACM Workshop on Hot Topics in Networks (HotNets-IV), College Park, MD, 2005","venue":null,"work_id":"38384177-8016-4437-9aaa-524138ecfdbc","year":2005},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.323520Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:83ffabfc9b7338386a0910c5ec6b68fdd402d53a1c3fcf23587123121491913e","observation_id":"085a062e-7873-4d4d-87bf-6f2a28a46938","resolution":{"observed_at":"2026-08-16T00:16:54.098945Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.078942Z","title":"Freedman, Justin Pettit, Jianying Luo, Nick McKeown, and Scott Shenker","venue":null,"work_id":"689f70a8-0ca7-45d2-97a1-da63bfa597a2","year":2007},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.328579Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:54b79e4006665379eb3cfb1b741bbacedbba18e20c883faf43f61ebbd50e596f","observation_id":"ac23da05-14a3-4f9e-ba6b-6351207f1f80","resolution":{"observed_at":"2026-08-16T00:16:54.083703Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.064786Z","title":"Freedman, Dan Boneh, Nick McKeown, and Scott Shenker","venue":null,"work_id":"5d012f23-c261-455d-9779-7431bc3a4242","year":2006},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.334111Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:1da6276c96d45e4085d57bcf38c28cb5ae69913effafe53560fb1719e3e53051","observation_id":"9742d581-a98e-4778-9ff6-d7453dbaab05","resolution":{"observed_at":"2026-08-16T00:16:54.069453Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.049248Z","title":"{StruQ}: Defending against prompt injection with structured queries","venue":null,"work_id":"892af39b-ecfe-4d5f-bfb2-f16f9967e7eb","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.339433Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:02330e38c5725454a95c30da75fccb89b56e5cc6e03d82e35b2de51d7f57a278","observation_id":"22ba1fa3-3d01-42f6-a726-dacd082a736b","resolution":{"observed_at":"2026-08-16T00:16:54.054036Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.344313Z","title":"Secalign: Defending against prompt injection with preference optimization","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.344313Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:f30779ba8822f1d1e95c473e3b4b48d3749d7a969733b03975743df74888c44f","observation_id":"0fb0ed77-c5b1-4fcf-97e5-3e97c8b89892","resolution":{"observed_at":"2026-08-16T00:16:52.344313Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.348775Z","title":"Agentpoison: Red-teaming llm agents via poisoning memory or knowl- edge bases.Advances in Neural Information Processing Systems, 37:130185–130213, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.348775Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:ccf98b1b54418dbfba4400fbc5922e13e472adb225f7072bcfae5ad18e225f78","observation_id":"0334ae0a-09da-44dc-9871-32a9fb6b030c","resolution":{"observed_at":"2026-08-16T00:16:52.348775Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.015598Z","title":"Overprivileged by design: AI agents as cloud escalation vectors","venue":null,"work_id":"54bfa993-fc7d-4af1-9f93-e4e483cf2782","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.353237Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:eb9df063cf78f52b310bd84b3b0d00f9728a8af257b34ae0a16a9202f8a4951e","observation_id":"b36724f7-1f7b-4d93-9381-ed66a003bfb7","resolution":{"observed_at":"2026-08-16T00:16:54.020107Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.23643","last_updated":"2025-09-03T12:30:47Z","snapshot_observed_at":"2026-07-06T21:33:02.686798Z","submitted_at":"2025-05-29T16:50:41Z","title":"Securing AI Agents with Information-Flow Control","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.23643","snapshot_observed_at":"2026-08-16T00:16:52.357689Z","title":"Securing ai agents with information-flow control.arXiv preprint arXiv:2505.23643, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.357689Z"},"links":{"cited_paper":"/paper/2505.23643","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:167d233ac0c0a6a31051384189d63732a8cf9eaf5f034237a3bb587acf1302e9","observation_id":"10c52286-c590-4493-99a8-3e7a23025f32","resolution":{"observed_at":"2026-08-16T00:16:52.357689Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-17T17:40:10.591866Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-16T00:16:52.362927Z","title":"Defeating prompt injections by design.arXiv preprint arXiv:2503.18813, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.362927Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:03d3fbae13cb0ec93b7968ba53b8654bb0a0cb8a52e232a70b1bd566ab2fda25","observation_id":"4d423be8-c845-4d2b-ad13-3306bed23c1e","resolution":{"observed_at":"2026-08-16T00:16:52.362927Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.000024Z","title":"AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents","venue":null,"work_id":"06097ded-21b0-46d0-940d-ed8e2ab594d2","year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.367655Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:bafd73fea36506a6100b8e2aa6b0714ed52b38e8aafa8b1e338caaaf93a0b2f3","observation_id":"1a09a59c-fecb-44a5-a867-1443ac50449a","resolution":{"observed_at":"2026-08-16T00:16:54.005425Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.372005Z","title":"Ai agents under threat: A survey of key security challenges and future pathways.ACM Computing Surveys, 57(7):1–36, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.372005Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:4282a9889ccf4cc2e9f3e7caef6db141c1c361499d8cff30dabd7031bb8499c7","observation_id":"5d732177-794b-4a5f-a7fe-332b5dd6d2f2","resolution":{"observed_at":"2026-08-16T00:16:52.372005Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.975979Z","title":null,"venue":null,"work_id":"eca0f44c-865b-4a0d-86fd-1a5fcf02f05e","year":1987},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.376540Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:bf87a0b4f1a6ff0f527943fcb75f7d60cb2c9f02fb00d0ccbfd7146420000f64","observation_id":"14a28adc-8e32-4b04-8a6f-ca792ee3b9cc","resolution":{"observed_at":"2026-08-16T00:16:53.980500Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.961420Z","title":"Memory injection attacks on llm agents via query-only interaction.Advances in Neural Information Processing Systems, 38:46697–46731, 2026","venue":null,"work_id":"961a3f32-f5d6-4fd2-99c4-68f292418b01","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.381100Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:b1d863df9bc49ed058e162bb6c67a5823af5bfe42df96e10089910ae6b1e02da","observation_id":"abdb78e1-07bf-4c0c-ad3f-540f869ee3ae","resolution":{"observed_at":"2026-08-16T00:16:53.965986Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.947519Z","title":"Towards verifiably safe tool use for llm agents","venue":null,"work_id":"29579fb5-3a7c-4c88-9712-3fcaad6be48f","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.385629Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:65a80c47da1e81838d95039ae72865baa262680701086503c2ca0a5083d9b08e","observation_id":"afa7f544-284d-42f7-80a1-682cc86e9981","resolution":{"observed_at":"2026-08-16T00:16:53.952047Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.389986Z","title":"AgentLeak: A full-stack benchmark for privacy leakage in multi-agent LLM systems.arXiv preprint arXiv:2602.11510, February 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.389986Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:b825d461bf5a45cf853f8cd6208415f0adde67b241c52f20bffc667f99d626af","observation_id":"a96d1fef-c4fd-498d-b08e-444032087434","resolution":{"observed_at":"2026-08-16T00:16:52.389986Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.932921Z","title":"Wasp: Benchmarking web agent security against prompt injection attacks.Advances in Neural Information Processing Systems, 38, 2026","venue":null,"work_id":"a06d84d2-1bc7-4ec0-95d6-01556e8d4522","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.394299Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:f9a2683e6e3ee80c12f198e96eb990436ba1d4db6aa48d9001716cee86a25399","observation_id":"47c471bd-da43-4778-987e-87ab27143bc4","resolution":{"observed_at":"2026-08-16T00:16:53.937836Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.917742Z","title":"AI agents are the biggest data security threat you’re not governing","venue":null,"work_id":"16ea9726-8e3d-441b-baa0-1e078234ef17","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.398764Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:b0d2f314793d2502306e2b0cc1b46e48b8378a2521c2784c3b56530b32388a1c","observation_id":"bd14a932-ea5c-4abf-beac-791911997f00","resolution":{"observed_at":"2026-08-16T00:16:53.922661Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.903151Z","title":"Agent2agent (A2A) protocol","venue":null,"work_id":"002a3932-29ea-4951-bba2-c56d8a32e4aa","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.403122Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:2720e03ce83168878fdcf555549c77642a1ad264f78fb24dd97440f65fc05532","observation_id":"805acb9c-2d57-4b25-8f79-b61dc624336f","resolution":{"observed_at":"2026-08-16T00:16:53.907836Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.887435Z","title":"Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection","venue":null,"work_id":"5f0405ec-c9ca-4fe5-8f32-32eff2161745","year":2023},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.407983Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:03dceb6d7d83838f63ab915cba0a9f8133633450aa3d7f7161bd127165ff8bc7","observation_id":"3274f44a-94e6-4713-bd52-2347f864e27d","resolution":{"observed_at":"2026-08-16T00:16:53.892852Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.874114Z","title":"Bypassing LLM guardrails: An empirical analysis of eva- sion attacks against prompt injection and jailbreak detection systems, 2025","venue":null,"work_id":"3f86728d-e9a1-4c7d-96ee-9f5a8262a34e","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.412448Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:b3c4b8c8578f5b58e20535283856d07b04975dd0d284138d055c0f0d7ffa2621","observation_id":"14e2ac38-18e9-4ab8-a80b-8296a1587c9a","resolution":{"observed_at":"2026-08-16T00:16:53.878294Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.858737Z","title":"The OAuth 2.0 authorization framework","venue":null,"work_id":"6078a5a8-eb7e-470e-be35-a34368df00bc","year":2012},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.417816Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:2b1bf9390462c3f1e33c840e91b074cd5297a79b703b370816b5ff49679cb60e","observation_id":"096b3df7-3605-4b26-9a17-35957152ba5c","resolution":{"observed_at":"2026-08-16T00:16:53.864145Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.06674","last_updated":"2023-12-07T19:40:50Z","snapshot_observed_at":"2026-08-14T15:42:19.849118Z","submitted_at":"2023-12-07T19:40:50Z","title":"Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.06674","snapshot_observed_at":"2026-08-16T00:16:52.422410Z","title":"Llama guard: Llm-based input-output safeguard for human-ai conversations.arXiv preprint arXiv:2312.06674, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.422410Z"},"links":{"cited_paper":"/paper/2312.06674","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:d86ca08f25f66f91924d810240fb24ff4428b786591157c4559d119c6b40dc9c","observation_id":"42e92a12-2d7e-4a9f-9608-4b5405e86323","resolution":{"observed_at":"2026-08-16T00:16:52.422410Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.426857Z","title":"Break- ing and fixing defenses against control-flow hijacking in multi-agent systems.arXiv preprint arXiv:2510.17276, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.426857Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:3dcb18b2f0dbf6d022d24211c31e6e6b0341b81762eaf5997540769bf021c7ad","observation_id":"ad8ee4e6-8e34-41c1-9042-17c252d61947","resolution":{"observed_at":"2026-08-16T00:16:52.426857Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.841809Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in LLM agents","venue":null,"work_id":"70002660-6305-4c60-9418-8658536e4ce8","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.430727Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:a8ee90c25a15908959bec908e808e9e9d71297149722804caad44dc8bc3d7689","observation_id":"6e52efd2-8208-4a1e-921e-7b31bea700d2","resolution":{"observed_at":"2026-08-16T00:16:53.846847Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18333","last_updated":"2025-05-23T19:39:56Z","snapshot_observed_at":"2026-08-07T14:30:46.734293Z","submitted_at":"2025-05-23T19:39:56Z","title":"A Critical Evaluation of Defenses against Prompt Injection Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.18333","snapshot_observed_at":"2026-08-16T00:16:52.434773Z","title":"A critical evaluation of defenses against prompt injection attacks.arXiv preprint arXiv:2505.18333, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.434773Z"},"links":{"cited_paper":"/paper/2505.18333","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:c6773bc0cfddab7ec3a0da7b2c21d8c50fbc1762cfc34e04585b9a6062997d9d","observation_id":"304440f1-a086-4495-a037-cd6867237972","resolution":{"observed_at":"2026-08-16T00:16:52.434773Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2602.08235","last_updated":"2026-06-06T21:46:49Z","snapshot_observed_at":"2026-08-14T06:34:27.145671Z","submitted_at":"2026-02-09T03:20:11Z","title":"When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2602.08235","snapshot_observed_at":"2026-08-16T00:16:52.438925Z","title":"When benign inputs lead to severe harms: Eliciting unsafe unintended behaviors of computer-use agents.arXiv preprint arXiv:2602.08235, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.438925Z"},"links":{"cited_paper":"/paper/2602.08235","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:afb37bc69e8da4d6b3cff532d6413b05806d28956541c202b528eee04ab2d070","observation_id":"3fa22a94-faa1-4e26-89f4-769eb59c2aef","resolution":{"observed_at":"2026-08-16T00:16:52.438925Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.826640Z","title":"Frans Kaashoek, Eddie Kohler, and Robert Morris","venue":null,"work_id":"8d0ab5e7-5d06-4e53-b73e-ac5608690ccb","year":2007},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.444062Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:2632fba3b3b6f36d78a82b45c0288d56ddadab89cfca8263e4a0b2e7b4b274d7","observation_id":"d9f6ab40-a906-4dc3-bcbc-96f77a87229d","resolution":{"observed_at":"2026-08-16T00:16:53.831339Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.811350Z","title":"Lakera guard","venue":null,"work_id":"d5984e63-c4de-4602-86ed-25d24c6afafe","year":2023},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.448593Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:bdf4e4bff69276e26e82ff8043bdd38a5369a1156a12bcbb11d813a71097c59c","observation_id":"bbbe41cc-bd09-411d-bdb0-31dba52f50a1","resolution":{"observed_at":"2026-08-16T00:16:53.816326Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.795780Z","title":"Inan, Sahar Abdelnabi, Janardhan Kulka- rni, Lukas Wutschitz, Reza Shokri, Christopher G","venue":null,"work_id":"946cf3fb-9942-483b-8a8e-5590cea533ea","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.452882Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:431c4964390da8dde2ac4648ffe42172800b3ed59da9a6eabebb8181f1441c6f","observation_id":"278e6b90-2561-48ca-80ea-0f884286fc83","resolution":{"observed_at":"2026-08-16T00:16:53.800917Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.780614Z","title":"Improving google a2a protocol: Protecting sensitive data and mitigating unintended harms in multi-agent systems.ACM Transactions on Software Engineering and Methodology, 2025","venue":null,"work_id":"cbe33c15-7940-48af-8050-db2c2ac6731c","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.457328Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:b924b0e9321599c28546f256b12b7d85f23efa9ea045f573a5c5895937dc5b2c","observation_id":"c532226d-88ca-4992-b06f-1d85fee1064c","resolution":{"observed_at":"2026-08-16T00:16:53.785731Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.06284","last_updated":"2026-04-07T12:19:55Z","snapshot_observed_at":"2026-08-13T12:23:49.411000Z","submitted_at":"2026-04-07T12:19:55Z","title":"ClawLess: A Security Model of AI Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.06284","snapshot_observed_at":"2026-08-16T00:16:52.461950Z","title":"Clawless: A security model of ai agents.arXiv preprint arXiv:2604.06284, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.461950Z"},"links":{"cited_paper":"/paper/2604.06284","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:ad308a194cc6a917927fcf15322d7890c51a007adf2a1737502f6cd72d7553f5","observation_id":"e45143a1-69f0-49d0-871a-87ea66245a92","resolution":{"observed_at":"2026-08-16T00:16:52.461950Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.466663Z","title":"Agentauditor: Human-level safety and security evaluation for llm agents.Advances in Neural Information Processing Systems, 38:43241–43298, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.466663Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:45ca0e201d83f24c7909926c8cbac176d7dfed401596000c774fcd7d6af8305c","observation_id":"090b13fd-312f-4d4d-83f9-4f61e491471e","resolution":{"observed_at":"2026-08-16T00:16:52.466663Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.754375Z","title":"A holistic approach to undesired content detection in the real world.Proceedings of the AAAI Conference on Artificial Intelligence, 37(12):15009–15018, 2023","venue":null,"work_id":"e85aad0b-ca0e-4be5-ab99-ad748514c44a","year":2023},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.471715Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:3c24d7aef75edc3d8234b550b9fa56415efcda730bf4fb7a598ce557f9028452","observation_id":"442b940f-952c-4a86-a9d5-1b2a443258f3","resolution":{"observed_at":"2026-08-16T00:16:53.759446Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.739381Z","title":"Same model, different hat","venue":null,"work_id":"51a5ab86-77e0-4e1a-9e44-c21ed59a69df","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.476231Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:ad77a9ffad241040207c49fc724d94fe73a2e7857162db859dbbdc4e532e1a94","observation_id":"2f405ee0-9e96-42d5-97a8-4e2301388037","resolution":{"observed_at":"2026-08-16T00:16:53.744203Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.480555Z","title":"cell- mate: Sandboxing browser ai agents.arXiv preprint arXiv:2512.12594, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.480555Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:ee0fff465d33069af6535655ffa61517d4b867b26b458b89d79d43ca837a23ce","observation_id":"cc114753-dc35-4cc2-8ee8-5baf3c84c28f","resolution":{"observed_at":"2026-08-16T00:16:52.480555Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.485071Z","title":"Veriguard: Enhancing llm agent safety via verified code generation.arXiv preprint arXiv:2510.05156, 2025","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.485071Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:93a87c977ebd93c6292c6da45a2a3614ab969c0d358213cf86c27a62c106765a","observation_id":"131827f3-1758-499a-9774-f03e7d663a3d","resolution":{"observed_at":"2026-08-16T00:16:52.485071Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.723590Z","title":"Can LLMs keep a secret? Testing privacy implications of language models via contextual in- tegrity theory","venue":null,"work_id":"b09e060f-cf58-4e57-b29b-893456bbd40b","year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.489966Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:aac933955970e0981190c088e665172f58dd92fd8b371a72cde9d74a2281688d","observation_id":"50dfe044-bab5-4465-88c6-05ce4b5a19bb","resolution":{"observed_at":"2026-08-16T00:16:53.728575Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.708781Z","title":"Myers and Barbara Liskov","venue":null,"work_id":"65624091-58b8-4a8b-8962-0704dcf92689","year":1997},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.495140Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:896afb0208d77c596d6e7a34530838d4f9c2ff37d33f2b2f8d4c698cb12219b0","observation_id":"9b6b5d19-4a5b-4f10-ac96-cdcf9726ff52","resolution":{"observed_at":"2026-08-16T00:16:53.713491Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.499684Z","title":"Omni-leak: Orchestrator multi-agent net- work induced data leakage.arXiv preprint arXiv:2602.13477, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.499684Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:a857271004d051400248ba2e8b43cad169cb63ad5ef48bc700bc7e9ff57d9669","observation_id":"069a84aa-156b-461f-81c9-a4922b5f4b3b","resolution":{"observed_at":"2026-08-16T00:16:52.499684Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.19956","last_updated":"2025-05-02T18:42:42Z","snapshot_observed_at":"2026-08-16T05:36:44.756300Z","submitted_at":"2025-04-28T16:29:24Z","title":"Securing Agentic AI: A Comprehensive Threat Model and Mitigation Framework for Generative AI Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.19956","snapshot_observed_at":"2026-08-16T00:16:52.504149Z","title":"Securing agentic ai: A com- prehensive threat model and mitigation framework for generative ai agents.arXiv preprint arXiv:2504.19956, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.504149Z"},"links":{"cited_paper":"/paper/2504.19956","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:ef8e7e392652523fb85969723ed75dadd5dfb4c4c6e3fc139177eec117435f12","observation_id":"5511faee-4228-44ad-9675-d5451e996a66","resolution":{"observed_at":"2026-08-16T00:16:52.504149Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.695263Z","title":"Privacy as contextual integrity.Washington Law Review, 79(1):119–157, 2004","venue":null,"work_id":"e35ed19a-1c13-4788-9e9e-f1c7fcac3d00","year":2004},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.509103Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:baf13d1839ef2802fba420d7a53704a8e53948c6febda9f25f34c25df1baa28f","observation_id":"8ce2dff6-41c4-42ae-98b4-c42a38b1fe79","resolution":{"observed_at":"2026-08-16T00:16:53.699595Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.681657Z","title":"Why traditional security fails in the age of non- deterministic AI","venue":null,"work_id":"85d53a5e-3016-4be6-b3ce-4dd274334992","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.513767Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:fd0e19b5c128cab787045b0eac7f912c95f1cac192da782244be0b1996861cdd","observation_id":"4a089823-b7eb-4048-963d-ad3800069634","resolution":{"observed_at":"2026-08-16T00:16:53.685891Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.16248","last_updated":"2025-07-09T01:38:20Z","snapshot_observed_at":"2026-08-16T12:48:14.367296Z","submitted_at":"2025-03-20T15:44:31Z","title":"Real AI Agents with Fake Memories: Fatal Context Manipulation Attacks on Web3 Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.16248","snapshot_observed_at":"2026-08-16T00:16:52.518336Z","title":"Real ai agents with fake memories: Fatal context manipulation attacks on web3 agents.arXiv preprint arXiv:2503.16248, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.518336Z"},"links":{"cited_paper":"/paper/2503.16248","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:d3a30c7be4764615ebb0bbc7c9a8b297cb87496d6f6c16fd2a952cc6ea67675a","observation_id":"3d25ab42-31cf-458e-94d5-2162e3228003","resolution":{"observed_at":"2026-08-16T00:16:52.518336Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.523086Z","title":"Agentbay: A hybrid interaction sandbox for seamless human-ai intervention in agentic systems.arXiv preprint arXiv:2512.04367, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.523086Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:42efbb9c642d4c7e82b304d27b8183bc9d1d116802e4a4f4c94985f68252bbf3","observation_id":"9ab5920f-18cb-49f4-b5b9-91884042d05a","resolution":{"observed_at":"2026-08-16T00:16:52.523086Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.18583","last_updated":"2026-05-18T16:00:41Z","snapshot_observed_at":"2026-07-06T23:29:29.105126Z","submitted_at":"2026-05-18T16:00:41Z","title":"Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.18583","snapshot_observed_at":"2026-08-16T00:16:52.527562Z","title":"Overeager coding agents: Measuring out-of-scope actions on benign tasks.arXiv preprint arXiv:2605.18583, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.527562Z"},"links":{"cited_paper":"/paper/2605.18583","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:6c2fedf15e51915d5c892b9f57b5b66acb2d56ce3cf4bcb80b55bb1d97741e58","observation_id":"921df08d-5ba6-4670-a5c6-4363430229fb","resolution":{"observed_at":"2026-08-16T00:16:52.527562Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.667852Z","title":"NeMo guardrails: A toolkit for controllable and safe LLM applications with programmable rails","venue":null,"work_id":"0787a4ac-946d-4c4e-8eae-a42a37453bc6","year":2023},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.532549Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:e31bbb71237ca44d9170078a668ff8661b45c4b895323181ad475d315175ba4a","observation_id":"2b87b12c-7b12-4222-bb91-42439fdce24d","resolution":{"observed_at":"2026-08-16T00:16:53.672607Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.652405Z","title":"Zero trust architecture","venue":null,"work_id":"d93dda17-ee1d-413b-b6d6-4710217ea97c","year":2020},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.537273Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:f86c104dc13486db4e7aaa9fb0a5fb5668412bf5103e662d2af63f935c6e5194","observation_id":"b8655260-9447-4835-b15f-934814a0e315","resolution":{"observed_at":"2026-08-16T00:16:53.657947Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.635538Z","title":"Saltzer, David P","venue":null,"work_id":"80cc60f1-44f4-4c61-a3dc-b4086f6b3802","year":1984},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.541066Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:51dd7769a5907bfec96126f137418b1b6470802c75ddd59250b21aa041717412","observation_id":"c3cf9970-a376-4692-9cd8-1ea295bc4162","resolution":{"observed_at":"2026-08-16T00:16:53.641760Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.620693Z","title":"Saltzer and Michael D","venue":null,"work_id":"f9ed1b28-ee1b-41f7-b0be-4ee287dcff96","year":1975},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.545194Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:b60f0171306ba6ece5490b12c5de1491ccd4d802c08e8beb40e9a7efa2bfcf32","observation_id":"38eed1c4-1e1e-456b-a39e-017d6868533b","resolution":{"observed_at":"2026-08-16T00:16:53.625403Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.605066Z","title":"Sandhu, Edward J","venue":null,"work_id":"7a64d38d-8fd3-411d-92f4-c9aaf3a0ef68","year":1996},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.548940Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:236a33364d9a08781b18cf7e60100bb6fbf25656b1332d7bec74d21a61eec728","observation_id":"e940e040-cba9-4421-9736-6850d2a20f13","resolution":{"observed_at":"2026-08-16T00:16:53.610001Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.589374Z","title":"Pri- vacyLens: Evaluating privacy norm awareness of language models in action","venue":null,"work_id":"ad1df516-bb17-449c-b0a1-d3966d708efa","year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.552823Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:41c2ccca9d90bebe1d5db05737aa3b5e0b11f26eadfc8628737395aa96211474","observation_id":"7a57f245-ebd7-4ee6-8e9c-2307eb25f17a","resolution":{"observed_at":"2026-08-16T00:16:53.594727Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.573981Z","title":"Rollback-recovery for middleboxes","venue":null,"work_id":"a159cd5b-383d-4133-a09f-5a785d3797d2","year":2015},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.557035Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:81c2956508954ff5751b4557414bbaff805502aed92aa97b69a2f1d04efbd55a","observation_id":"e7da0d6e-0a99-42be-9729-2f18aa7f6977","resolution":{"observed_at":"2026-08-16T00:16:53.578873Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.557346Z","title":"Making middleboxes someone else’s problem: Network processing as a cloud service","venue":null,"work_id":"75487493-341d-4532-b733-a29c8e5c6685","year":2012},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.561326Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:a8a6c19c6385f51014a1159dec27ffb103682aa9d00161ca2cc5a02cedb4fee4","observation_id":"a2d74c86-6d82-4e25-9cc5-cfb8197de3e3","resolution":{"observed_at":"2026-08-16T00:16:53.563237Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.541738Z","title":"BlindBox: Deep packet inspection over encrypted traffic","venue":null,"work_id":"a3500252-8330-4cba-a0e1-ac75d140e64e","year":2015},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.565286Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:be43cc3c286122988b5ed30524731cb8acba1f5cb0fb6b67b282f58076fb2117","observation_id":"35ffd793-4f73-4ec1-9e49-f064a3a4a900","resolution":{"observed_at":"2026-08-16T00:16:53.546824Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.525190Z","title":"Progent: Programmable privilege control for llm agents.arXiv e-prints, pages arXiv–2504, 2025","venue":null,"work_id":"ef7235f7-58c3-4643-87d2-8acccd978e2b","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.570710Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:2abd18cde0551553d37f22ecdc4628af24c4f6124ff66aae8b5f539a683067af","observation_id":"4ee59f58-654d-4619-8d57-9397e3a25186","resolution":{"observed_at":"2026-08-16T00:16:53.530999Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2605.31042","last_updated":"2026-05-29T09:19:07Z","snapshot_observed_at":"2026-08-18T00:24:11.519463Z","submitted_at":"2026-05-29T09:19:07Z","title":"From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.31042","snapshot_observed_at":"2026-08-16T00:16:52.575056Z","title":"From prompt injection to persistent control: Defending agentic harness against trojan backdoors.arXiv preprint arXiv:2605.31042, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.575056Z"},"links":{"cited_paper":"/paper/2605.31042","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:be80ded529f6d54502efd52a7228989acc1408640527f4dd4b57acfd833e7f96","observation_id":"2174ba0f-82f6-4ec8-af11-665a1b2323b0","resolution":{"observed_at":"2026-08-16T00:16:52.575056Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.508597Z","title":"AI agents are becoming authorization bypass paths","venue":null,"work_id":"22f6135c-e033-4fb4-9c6c-71007c8c76b8","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.579775Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:d9cc935019489ec347d32a3292cbeaecc7551f6323bd74fa89458106edded936","observation_id":"bddfdab1-8b69-45c3-a993-89ccd1560a7f","resolution":{"observed_at":"2026-08-16T00:16:53.513775Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-11T23:45:02.178667Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-08-16T00:16:52.583963Z","title":"The instruction hierarchy: Training llms to prioritize privileged instructions.arXiv preprint arXiv:2404.13208, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.583963Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:ee529e7cf17446290b7fc81419150ca05100207a24bef8ff0c68bc7d34d04c59","observation_id":"798cea79-2e4d-4e8e-ba7b-28b3843d9506","resolution":{"observed_at":"2026-08-16T00:16:52.583963Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.493029Z","title":"Privacy in action: Towards realistic privacy mitigation and evaluation for LLM-powered agents","venue":null,"work_id":"099eb368-ff05-4276-b557-5b122659cdb2","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.588580Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:2f92fabe7cdecf688f72108fb2fbce1c26b0eff031287d983ad7669952a6c639","observation_id":"3cbe6a92-cb31-4c05-874e-93726b8777f5","resolution":{"observed_at":"2026-08-16T00:16:53.498000Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.477327Z","title":"Sok: Evaluating jailbreak guardrails for large language models","venue":null,"work_id":"9bd96874-03e5-47c0-8d27-f63837527b6b","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.593006Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:25af40ae243312d658cca7f0183ebf7df63044a886eb04ff3167a5a099eeca7f","observation_id":"81453714-72fd-42b8-b3fc-6b302b4f9afc","resolution":{"observed_at":"2026-08-16T00:16:53.482391Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.04960","last_updated":"2025-01-30T22:55:18Z","snapshot_observed_at":"2026-08-16T14:11:47.014972Z","submitted_at":"2024-03-08T00:02:30Z","title":"IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.04960","snapshot_observed_at":"2026-08-16T00:16:52.597372Z","title":"Isolategpt: An execution isolation architecture for llm- based agentic systems.arXiv preprint arXiv:2403.04960, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.597372Z"},"links":{"cited_paper":"/paper/2403.04960","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:184c09c0334f27ad6eb9e2ef8304764336063fd69cc56cd68606d6e89a22a881","observation_id":"55a336a1-8651-4753-8173-270eafd5b5e7","resolution":{"observed_at":"2026-08-16T00:16:52.597372Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.09187","last_updated":"2025-05-29T03:09:05Z","snapshot_observed_at":"2026-07-06T18:30:23.849880Z","submitted_at":"2024-06-13T14:49:26Z","title":"GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.09187","snapshot_observed_at":"2026-08-16T00:16:52.602071Z","title":"Guarda- gent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning.arXiv preprint arXiv:2406.09187, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.602071Z"},"links":{"cited_paper":"/paper/2406.09187","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:e086bf7ad86119bcb19b25bdc2f94b4d645a9a27782636245455bcc12105783f","observation_id":"74e8b5f8-adc1-4ee6-b059-2ff98c63d02e","resolution":{"observed_at":"2026-08-16T00:16:52.602071Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.461197Z","title":"SIFF: A stateless internet flow filter to mitigate DDoS flooding attacks","venue":null,"work_id":"5d3161e3-b315-4d76-a970-694e191cec51","year":2004},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.607052Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:9791f889b0de6cc4631ae6240fb5ebf4ff4e6fcba0f4165273d587056ba3d571","observation_id":"4a45c84b-e8d1-4c47-81fc-feee9fb2654b","resolution":{"observed_at":"2026-08-16T00:16:53.466718Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.445925Z","title":"A DoS- limiting network architecture","venue":null,"work_id":"4b3032bd-7fcc-43c1-b0f0-0ff7d47a2023","year":2005},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.611415Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:2c8be043dda3bf73087fd0d5ab4f7511d0c2c815b3840062d27323af6bf770eb","observation_id":"c3312728-17f5-4e05-8cba-74ada3c8feb5","resolution":{"observed_at":"2026-08-16T00:16:53.450831Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.616158Z","title":"ReAct: Synergizing reasoning and acting in language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.616158Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:b7febf2b5ade71fd63ecb021ec2e6ea2a1f65b133855772e308d9be15ad6d459","observation_id":"b02123c1-dbfb-497b-a416-dee577e8c4a3","resolution":{"observed_at":"2026-08-16T00:16:52.616158Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.420131Z","title":"Temporal dynamics of mem- ory poisoning in web3-style llm agents.IEEE Access, 2026","venue":null,"work_id":"36c7a129-94a3-4bed-ac18-9690d238ff91","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.620509Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:871fc6e11b80a811b816382bac148eb1366cac60e746a8b297054663733a91a7","observation_id":"d749151e-5914-4f48-8875-690664504b3c","resolution":{"observed_at":"2026-08-16T00:16:53.425044Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.403812Z","title":"Making information flow explicit in HiStar","venue":null,"work_id":"19c6966c-c4af-41a6-87d2-934beebbbf11","year":2006},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.625041Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:30894fcf18f704ae9a80ea1b69e87650fb27a1e31e52286a1f6e41ffaa6b61bd","observation_id":"524731c4-3e4c-4b1a-bd71-5b83f9c00d9c","resolution":{"observed_at":"2026-08-16T00:16:53.409351Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.629850Z","title":"Injecagent: Benchmarking indirect prompt injections in tool-integrated large lan- guage model agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.629850Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:a63dc00b1c1578e70e6b58ed18b656262a421aeffd47f0c02c4bd4d084254a48","observation_id":"26f6f9af-a124-467e-b693-d47653751744","resolution":{"observed_at":"2026-08-16T00:16:52.629850Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.10807","last_updated":"2025-06-12T10:17:02Z","snapshot_observed_at":"2026-08-15T20:23:53.531433Z","submitted_at":"2024-12-14T12:11:26Z","title":"Towards Action Hijacking of Large Language Model-based Agent","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.10807","snapshot_observed_at":"2026-08-16T00:16:52.634434Z","title":"Towards action hijacking of large language model-based agent.arXiv preprint arXiv:2412.10807, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.634434Z"},"links":{"cited_paper":"/paper/2412.10807","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:7772be59ee9fdcea6a1e0d63957bd9ad81e69f2e1085cc245b1704c49141b9fe","observation_id":"e9121ddc-0084-4c58-b0a5-a12b43efabfc","resolution":{"observed_at":"2026-08-16T00:16:52.634434Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.377900Z","title":"AgentDAM: Privacy leakage evaluation for autonomous web agents","venue":null,"work_id":"d8f44d39-c7cf-4ce8-a7a1-f6b0e5b7dc13","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.639378Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:1ae165752b1f029308689f49a52acf5e34c882275df0651bfda8c25140c53b62","observation_id":"fe36e78b-b5bf-4996-8d88-d11f94fc0f72","resolution":{"observed_at":"2026-08-16T00:16:53.382866Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-07T23:01:30.196995Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-16T00:16:52.643873Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage.arXiv preprint arXiv:2502.08966, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.643873Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:c1baf1313cf9c9bf1e9e9afb23faeded037d4d7c881443f360094c5032c0a4a8","observation_id":"8e10ec44-80f8-4ff2-94f6-1c098895bc68","resolution":{"observed_at":"2026-08-16T00:16:52.643873Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.355300Z","title":"Rescriber: Smaller- LLM-powered user-led data minimization for LLM-based chatbots","venue":null,"work_id":"f62e55b8-8f05-4018-afe4-eb97689c8e6c","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.648792Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:94630f051bdd685d052044ba31655ea93a397cb356c013cd39e16da0db43de84","observation_id":"a11e147c-8315-4aff-9114-684a09cfc24b","resolution":{"observed_at":"2026-08-16T00:16:53.363098Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.17332","last_updated":"2025-06-24T04:10:59Z","snapshot_observed_at":"2026-08-16T12:47:52.443525Z","submitted_at":"2025-03-21T17:32:32Z","title":"CVE-Bench: A Benchmark for AI Agents' Ability to Exploit Real-World Web Application Vulnerabilities","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.17332","snapshot_observed_at":"2026-08-16T00:16:52.653903Z","title":"Cve-bench: a benchmark for ai agents’ ability to exploit real-world web application vulnerabilities.arXiv preprint arXiv:2503.17332, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.653903Z"},"links":{"cited_paper":"/paper/2503.17332","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:982f10edf501b3d28045218b36719b1870c586198784b7d1b182cf289ab7576d","observation_id":"97d3c3fa-887f-4d8e-bf85-d9d2c3c98277","resolution":{"observed_at":"2026-08-16T00:16:52.653903Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.318565Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.318565Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:125e670fa9f38fbbc5e9429ab16840a75ccfb8f63db2954de2f7ae1f4b19f99a","observation_id":"51282d5b-1aa8-4e13-afdd-045001046885","resolution":{"observed_at":"2026-08-16T00:16:52.318565Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","latest_version":1,"primary_category":"cs.MA","snapshot_observed_at":"2026-08-18T03:25:24.075243Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem"},"reference_resolution":{"displayed":77,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":31,"verified_exact":0,"verified_fuzzy":46},"total_outbound_references":77},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"thesis":"As of 18 August 2026, this Paper Citation Record lists 77 of 77 outbound references and 0 inbound Pith citation observations for arXiv:2608.12172."}