Pith. sign in

Paper Citation Record · LEDGER

Prismata: Confining Cross-Site Prompt Injection in Web Agents

As of 20 August 2026, this Paper Citation Record lists 100 of 106 outbound references and 0 inbound Pith citation observations for arXiv:2607.08147.

A citation records a reference. It does not transfer a finding from one paper to another.

pith.paper-citation-record.v1
2607.08147 v1

Coverage vector

measured 100 of 106 reference resolution

Typed states for the displayed outbound observations.

Source: paper_references, paper_reference_links, observed 2026-07-10T12:20:03.672480Z

measured 100 of 100 standing notices

One-hop event checks from named stored sources.

Source: scholarly_work_events, retraction_status_cache, observed 2026-08-20T06:33:59.587034+00:00

measured 0 of 0 inbound itemization

Pith citing papers itemized under the disclosed page cap.

Source: paper_references, paper_reference_links

measured 0 of 1 external citation measurements

A source-named dated measurement, never combined with another source.

Source: cited_works

Reference resolution

100 of 106 outbound references displayed

  • verified exact49
  • verified fuzzy8
  • unresolved37
  • parse uncertain0
  • malformed identifier1
  • metadata mismatch5

External citation measurements

No source-named external measurement is stored.

Outbound references

Observation 9ed1892d-39d2-4ea4-ad76-3765c435f643 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 1

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.461705Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:1edfcccf0e1fcd711ceff9c27d086c315279bff1c016737a38b636e35a3e5a83

Observation 4bbf902e-ede2-472a-86ea-c25213a10203 · outbound

This paper cites 2024.Developing a computer use model.

Prismata: Confining Cross-Site Prompt Injection in Web Agents 2024.Developing a computer use model

Reference 2

Resolution
verified fuzzy
raw_fallback, observed 2026-07-10T12:27:04.424634Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:8b458727ebe7f20c4cd21519edb8f226a9d74f69f5813f9bd729e9e6fb7bf368

Observation 92b31706-380e-4579-a44a-4535e34d21d5 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 3

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.458643Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:a61aa6adab44b1f2c00baec77bbde607f106447ba2f83c2fa443bc3757777ad0

Observation 3842d1b1-8c53-4580-85f6-2212d4c876c6 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 4

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.412192Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:4845041064b25f4e60c579cb14688cbfcf23b1e3d675fd2e94f30a3426aadc32

Observation a36b4759-687b-4218-b34c-8c7b3ba7ef37 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 5

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.457155Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:d36e64cc4fbcd1d629798c2b4d5faf84915a4294ed17bf6a97674d7cc9bdc5e2

Observation 8b8b7c08-e707-4e6d-be6f-35f2f1b72de3 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 6

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.408862Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:e4478cf49d3ba763c748e9ff289657c5dbfd7761602f6300e2db70dcad910017

Observation bfd5d8d7-340e-4927-ae45-9a02af7cf509 · outbound

This paper cites Design Patterns for Securing LLM Agents against Prompt Injections.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Design Patterns for Securing LLM Agents against Prompt Injections

Reference 7

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.099528Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:26fe1c29e9f86cf102bedb065aa48c6785c25b6c03a61802edf80ae278ecc5c3

Observation 5e9c24f0-64b6-4dac-9c4b-6bee8bdb43f5 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 8

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.455691Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:cfe53d34ff5ce1115db289e348f5ce4038f1d05ca2b0ebf17aac215c3e3df690

Observation 99efca18-b351-4e11-9a95-253f05c0b8ea · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 9

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.454093Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:ff85b368fdba6d190cc33a06781d536ed8c4bc008133b4729c39837fcb30de32

Observation 207b19ef-cb81-4389-bde3-75545df790e4 · outbound

This paper cites StruQ: Defending Against Prompt Injection with Structured Queries.

Prismata: Confining Cross-Site Prompt Injection in Web Agents StruQ: Defending Against Prompt Injection with Structured Queries

Reference 10

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.058393Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:567c2496b6a201a0bed81a9629a1b8958e000531fc9b95d0680edd7a806f30dd

Observation a1942c66-4eca-43c5-bafc-0ca199290442 · outbound

This paper cites WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agents.

Prismata: Confining Cross-Site Prompt Injection in Web Agents WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agents

Reference 11

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.055591Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:0d283a417775f91dd54d03b049602702637d66595b7a767267922ef4832338b8

Observation 151b74eb-56d5-4b21-92e5-22db732711eb · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 12

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.452625Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:3a19d7112e6eb948ad15ab3b32870023ab80b4ce8c161802755258cca1d5d9b5

Observation cb7212e2-1c6c-4d47-adc1-190ef77d029d · outbound

This paper cites How not to detect prompt injections with an llm.

Prismata: Confining Cross-Site Prompt Injection in Web Agents How not to detect prompt injections with an llm

Reference 13

Resolution
metadata mismatch
arxiv_id, observed 2026-07-10T12:27:04.161716Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:bc3ed6c0428357062275daf64ae004d27d258a5109af673d92ab7cc51d9d942e

Observation 89914b78-06bf-40c5-8a52-327441f0fbe9 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 14

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.451081Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:6631309a3b9abe184e649b1fc33f61e6b333fa312ae833ac37ae18bea1989a21

Observation 7408b8a4-a073-4472-80b1-eb5883f95fda · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 15

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.447944Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:a91fbd88e7ff6911c6c774e7656f17c416c33f183d7ffce8a4e48ac3dbcd7327

Observation bfc1bfe1-7559-4a8a-a14f-47131b9b8ece · outbound

This paper cites Securing AI Agents with Information-Flow Control.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Securing AI Agents with Information-Flow Control

Reference 16

Resolution
metadata mismatch
local_arxiv, observed 2026-07-10T12:27:04.148644Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:7ce4649cae6aac907e5c09d1ffdcbd1c8dfb9a3484158210738dacfe9645222b

Observation ccfd81c9-52d2-4ac0-9354-4e2fa0f23205 · outbound

This paper cites Defeating Prompt Injections by Design.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Defeating Prompt Injections by Design

Reference 17

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.209196Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:2009c9af5a3e61534009bbc141d1e92a8bce55efd996850c67ca534d9876febe

Observation ef897733-b2f0-41ce-b9d6-449eb170e45f · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 18

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.446491Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:2e7ef64ec11c1e790c2a40c41282f016e5f1dc4985f8374756832f9f05579f48

Observation 0bb260aa-9fd6-4607-ac1d-c59548ad975d · outbound

This paper cites Mind2Web: Towards a Generalist Agent for the Web.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Mind2Web: Towards a Generalist Agent for the Web

Reference 19

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.117145Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:4fbbaa035a63ba2f59aec2c4853c8eb8be12540f94b522ba7f55fd93f510633f

Observation 0c0702df-0000-48b6-a172-b8e96a90b381 · outbound

This paper cites Laradji, Manuel Del Verme, Tom Marty, David Vazquez, Nicolas Chapados, and Alexandre Lacoste.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Laradji, Manuel Del Verme, Tom Marty, David Vazquez, Nicolas Chapados, and Alexandre Lacoste

Reference 20

Resolution
verified fuzzy
raw_fallback, observed 2026-07-10T12:27:04.445006Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:b145c05d759924520603a6fb576dafe8c47d3682633446bb0ebf07431bc136ab

Observation 959e9625-3a02-4e1f-aadd-af2e8403dbaf · outbound

This paper cites WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks.

Prismata: Confining Cross-Site Prompt Injection in Web Agents WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks

Reference 21

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.228939Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:badba98ef2f587d69c9c73a9f093901b5fc90f0503a90f790acc2482582d8c3a

Observation feca462b-7ad3-437f-8232-bfc0be91fb3e · outbound

This paper cites CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents.

Prismata: Confining Cross-Site Prompt Injection in Web Agents CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents

Reference 22

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.156803Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:969146204d1c1ef54b0b0570824a9332a6141ae14650f5f546e82a63e82d454b

Observation 645a0073-6baf-4156-a77e-90fd89d8fc14 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 23

Resolution
verified exact
doi, observed 2026-07-10T12:27:04.163418Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:6de826ff035daf895e9f39276decf683c286c09473fd04f6b0a587532a0958d0

Observation 430b0bf1-c1e4-49a4-a930-c90914908f98 · outbound

This paper cites FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts , booktitle =.

Prismata: Confining Cross-Site Prompt Injection in Web Agents FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts , booktitle =

Reference 24

Resolution
verified exact
doi, observed 2026-07-10T12:27:04.108615Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:c83e911c9d665d6e5ce22e1602f2b9ed7822b38406e8a4e80f4a8a8dbdef6ba9

Observation 13c0f375-bf0f-436d-a492-a35d7f2350d7 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 25

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.246549Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:fd45b08b2e2075bbbc52004ac942a2a2758f0ad5668e57f8e23c3c59882f204d

Observation 91638d94-6088-4f4f-970a-5ab824b3f64c · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 26

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.443247Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:7093e3721626066cf1012edb241aef2854083df740e37eae4ec05c0b32e8721a

Observation 2f1be916-6107-4a88-9bbc-4bed212cab73 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 27

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.441356Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:343427e0236dc934826e5094d3ddad804b44a124972b1704a7a5f8be8e358459

Observation 06f3fbdd-6444-4892-8c70-bc32bac3d968 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 28

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.439781Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:92d6280e450fd2f2bbd5fb6589849bc6f02032f240654d3ff546aef8538773d7

Observation 63d4aa18-e918-4c2b-bc5e-241e1a3c0bbc · outbound

This paper cites 2024.Buying Spying: Insights into Commercial Surveillance Vendors.

Prismata: Confining Cross-Site Prompt Injection in Web Agents 2024.Buying Spying: Insights into Commercial Surveillance Vendors

Reference 29

Resolution
verified fuzzy
raw_fallback, observed 2026-07-10T12:27:04.437728Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:3ceb4d54ec735c9b5f9de649353e074ec46d28e655e930ed51841cd87645c2f3

Observation b5cdfa6e-58b3-4daf-bfff-6ad7bc32e81f · outbound

This paper cites InProceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec @ CCS 2023).

Prismata: Confining Cross-Site Prompt Injection in Web Agents InProceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec @ CCS 2023)

Reference 30

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.088533Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:ebbd89921bad5adcb5f4b4daf768cda54717641cf159f677360866bb6844ff3e

Observation 2fc42c52-b94d-4f3e-85ba-2c8742f0d43a · outbound

This paper cites 2007.XSS Attacks: Cross-Site Scripting Exploits and Defense.

Prismata: Confining Cross-Site Prompt Injection in Web Agents 2007.XSS Attacks: Cross-Site Scripting Exploits and Defense

Reference 31

Resolution
verified fuzzy
raw_fallback, observed 2026-07-10T12:27:04.436046Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:f3da41e3b18a528d32d7c0af4c5a47c2ef3a7e80b731922889817fded5fb5816

Observation 61b8c471-2866-4a18-b028-6d0983ecbedc · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 32

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.111679Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:3db602e5580ce5b07d1cb59054a9a0d414a00580859c8ac6abe0d906be92ab5f

Observation 732c8734-c522-42e8-81c8-8e2133a7244c · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 33

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.434339Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:d4c945da00538307b34cc0bb422f6fa8dc9a67997dcf7d833bfe0a1f94cc71cc

Observation 680a7689-331d-4284-9dfc-bf4d93a7b01e · outbound

This paper cites AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents.

Prismata: Confining Cross-Site Prompt Injection in Web Agents AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents

Reference 34

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.203837Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:b3f50d64baa40db5a9608631eebae99ab82ded468cdc0b2733471b9fa3103c53

Observation bd275a84-b3a0-44d0-bf6a-7fbc054cf662 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 35

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.432844Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:0d7554d64a71d4f5e14d61aeb8e4393bf0d7faf554cf2265de0c0a6a18127ebf

Observation 05ca91fa-5da8-4657-af49-32317ee5d4a0 · outbound

This paper cites 2014.SafeFrames v1.1 Specification.

Prismata: Confining Cross-Site Prompt Injection in Web Agents 2014.SafeFrames v1.1 Specification

Reference 36

Resolution
verified fuzzy
raw_fallback, observed 2026-07-10T12:27:04.449575Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:1c66c9f418f69ca091e9b556e55e0cfb4dd100adb0ca9d6123b3732243c75336

Observation 29b0161e-57a1-4447-b999-729208bedcbd · outbound

This paper cites A Critical Evaluation of Defenses against Prompt Injection Attacks.

Prismata: Confining Cross-Site Prompt Injection in Web Agents A Critical Evaluation of Defenses against Prompt Injection Attacks

Reference 37

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.065942Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:72ddc2ebdfc06c1ea40e4fb4b93d794d738ba11854c3f7ebac51a0502a1583e2

Observation 90bb07a5-8afa-45e1-884c-6b85788bbca7 · outbound

This paper cites When ai meets the web: Prompt injection risks in third-party ai chatbot plugins.

Prismata: Confining Cross-Site Prompt Injection in Web Agents When ai meets the web: Prompt injection risks in third-party ai chatbot plugins

Reference 38

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.154222Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:4c4bcd8bd833625e69d0f65c49ed34631f1c6a4583f43d720d726908fed1c05b

Observation 833f5c4d-1bd5-4524-b943-85d8532a93d1 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 39

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.431074Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:61ac90d61cbcfadfd7ea8d57f9041453be4fea70c28c5eb27a8752721e483d77

Observation 2a71e710-8ad6-41b6-9c23-e08f9cd1fd82 · outbound

This paper cites VisualWebArena: Evaluating Multimodal Agents on Realistic Visual Web Tasks.

Prismata: Confining Cross-Site Prompt Injection in Web Agents VisualWebArena: Evaluating Multimodal Agents on Realistic Visual Web Tasks

Reference 40

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.071223Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:a29525a0d8e50c1c6a8d37fa5912b1974a180beea6fecf1f7a8bc69147a514d8

Observation 1f405e3c-67a4-4724-8bd9-de026c7e52cd · outbound

This paper cites Communications of the ACM , volume =.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Communications of the ACM , volume =

Reference 41

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.151227Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:6f8fc0b75f95e88b49bc45cf2b0f7a1e83132659a1ab812c0532d5e40c93c0ae

Observation 2390903c-db00-4ea5-89de-59768591be00 · outbound

This paper cites The cognitive firewall: Securing browser based ai agents against indirect prompt injection via hybrid edge cloud defense.

Prismata: Confining Cross-Site Prompt Injection in Web Agents The cognitive firewall: Securing browser based ai agents against indirect prompt injection via hybrid edge cloud defense

Reference 42

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.241695Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:dd371159d6f301529c304bb97917dce8bc02f01401e8ec506ebbaa6463c4b7be

Observation c77b9ee5-464a-4e11-b2d5-86cec6f6ce57 · outbound

This paper cites Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation

Reference 43

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.076461Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:6c1e3e6476a3b856910dd86fe9c6c2e4418e68f0ed00c8e334788463c7224476

Observation 2d606753-37e1-48b1-b1fe-9f38415b8e9a · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 44

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.429593Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:7ef48e7f60d53e7ca2203badb3ed834c87a5b13eb4903d0af3b0ab471cba1b41

Observation 9b8e1877-6ef2-483e-a8fb-b7d0c296f5dc · outbound

This paper cites In25th USENIX Security Symposium.

Prismata: Confining Cross-Site Prompt Injection in Web Agents In25th USENIX Security Symposium

Reference 45

Resolution
verified fuzzy
raw_fallback, observed 2026-07-10T12:27:04.460148Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:445ebd3504f3b172efb7699031c9481339e9e7ab2dc6b60b2bb90930e0a2fa68

Observation 54082bad-c27e-4015-95d7-64cc6507fe2f · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 46

Resolution
verified exact
doi, observed 2026-07-10T12:27:04.063278Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:bd2b27d82f796df2180ad02e53d02fe01f95d2ae36411bb13a84ead869291a6d

Observation 09232739-3b47-4587-adea-ada3ad50082f · outbound

This paper cites EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage.

Prismata: Confining Cross-Site Prompt Injection in Web Agents EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage

Reference 47

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.061309Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:e76c480a831ef94e152428e4017e762d18718bbda51643ec0bfc3565361b7788

Observation c27d4fe3-3efb-44b6-9110-e463d8b64179 · outbound

This paper cites Prompt Injection attack against LLM-integrated Applications.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Prompt Injection attack against LLM-integrated Applications

Reference 48

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.236378Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:afcb91e76626332efcb212fe7cce6e00d5d3fa56bf2c99158b5b7391c984a88c

Observation a7deb793-7bca-4f46-ac89-962beb6c5db5 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 49

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.427949Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:86a765ca6e188b7bc7581ae3c30f41d427c909adbb1935dbf4220280bae50bf0

Observation d27de9fc-ce34-490d-8364-84501722e9c7 · outbound

This paper cites In: IEEE Symposium on Security and Privacy (S&P).

Prismata: Confining Cross-Site Prompt Injection in Web Agents In: IEEE Symposium on Security and Privacy (S&P)

Reference 50

Resolution
metadata mismatch
arxiv_id, observed 2026-07-10T12:27:04.159194Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:ed758869745f8a33922747446a18e9d134d987ead06de64eec8d4594c9b53d26

Observation 21a81851-ca04-49ef-b2d3-172fc0dc118b · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 51

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.426370Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:6ed4634714a308e2b65ec3678645fa6a08522687341fcba8192c1413ed7513f2

Observation 92656bb2-3fb7-4004-9f97-7bfa0401a037 · outbound

This paper cites Caution for the Environment: Multimodal LLM Agents are Susceptible to Environmental Distractions.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Caution for the Environment: Multimodal LLM Agents are Susceptible to Environmental Distractions

Reference 52

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.129222Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:26dd005b0f4d41f3a39335913e75092367b61735f2a0fd7a43a7524b2b1969d2

Observation 7904fe81-fece-46ee-8132-b25f5b83fce0 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 53

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.398114Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:f90c523f07b30bf28ff32fd12a4fa4503df83668edadc2c34826733e6e7f63ba

Observation 5e902364-51d7-46a1-a3d6-204eb5b15ee4 · outbound

This paper cites Towards Enterprise-Ready Computer Using Generalist Agent.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Towards Enterprise-Ready Computer Using Generalist Agent

Reference 54

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.082589Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:94c836b2123504b827bf7ceb4207c95dc3140910d9d0f6fdc98098da69ef694b

Observation 00e84308-fbbf-454c-b33e-a0fef468a261 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 55

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.423125Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:6392b170e469a946ba6ad0e4606d92a605f22032997e5c664410dec616f67a1c

Observation dc5bd7ee-c62d-47e4-96d7-0a2a50f5f758 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 56

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.421599Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:b33a3dfb90e8f483fb48ab79537a1229194dbc74809e957ac7c881d605b5245c

Observation ef81614d-e34c-4405-890d-2f7fd7205994 · outbound

This paper cites cellmate: Sandboxing browser ai agents.

Prismata: Confining Cross-Site Prompt Injection in Web Agents cellmate: Sandboxing browser ai agents

Reference 57

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.124731Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:cc9d8872bf947e653ad257a1e1279bfca65f528351ec070bd15a371d65081868

Observation 17701626-789a-4c4e-9f53-54bcfee671ea · outbound

This paper cites The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections.

Prismata: Confining Cross-Site Prompt Injection in Web Agents The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections

Reference 58

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.222114Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:de33787a7cf3f05e34e598e591f392603a52aa51e8bbe247250344ac990f69af

Observation 8e8d4b0c-b21f-40a9-9a74-678b1c51ef98 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 59

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.122061Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:d30ccad182fae67054ed96bf6b66ab7e68c672040440f23d0f20216e736b42b2

Observation 20dd7db3-5ea4-415d-b30f-29e01c6cf4ca · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 60

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.419983Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:4ba5159b7456694f589bcd47a9b7750161fb980b8e8a734407524ef5158d3f9e

Observation 494ff69d-8bb1-4415-b94c-e1a88d88592a · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 61

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.418383Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:1fb495e9525448048bf2816b86956b30a37a79a6bec3c098dc92fb785150157b

Observation 254f794a-d47d-4e97-95d5-73f8db1c3d4c · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 62

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.463371Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:cda062480b9e08b9f7ec08ee416de9b6a5c77d43056c89564f0332549c64558d

Observation c681dc94-a2db-4778-9b37-264705c01290 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 63

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.416894Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:a4acdac2d7cda3161501d6ea1a3ef68e64bc16455d3727ba8a30132acc08e42f

Observation 85dc5f5a-4993-45bb-b021-a405f594eb0a · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 64

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.464783Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:bbfca070a19cf46a38c023b8866a854c8891d3e5c9a54ecf026ba5442024d6c8

Observation ad541f5c-7ebf-457f-bab0-461e31634381 · outbound

This paper cites Saltzer and M.D.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Saltzer and M.D

Reference 65

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.131792Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:56f25d03bb0f2967b330af9a456ff0a2d4d20a24fdf69cb980a9e85634028cd7

Observation c54ba00b-4323-4ba8-9389-33e17707c647 · outbound

This paper cites Prompt Injection Attack to Tool Selection in LLM Agents.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Prompt Injection Attack to Tool Selection in LLM Agents

Reference 66

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.091495Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:e67660b89783dba0363df81364616f9165b18e5c1072646924511abeda75552c

Observation e5f45ecf-29d2-411b-ad54-07be45a7b9c3 · outbound

This paper cites Progent: Securing AI Agents with Privilege Control.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Progent: Securing AI Agents with Privilege Control

Reference 67

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.219857Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:b6e226f25c05cbab947a4386b9b39c03e8e40aa4e7e139945f55c2185cfab9fd

Observation 9a1f4561-8eab-4941-80f5-7d97e8cb4a52 · outbound

This paper cites Permissive information-flow analysis for large language models.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Permissive information-flow analysis for large language models

Reference 68

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.134278Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:ef4efbdd73f7b4f32e26a043e88d353c46cc2b9b6d5d04fc2da080cd076a3ca2

Observation cfa8d287-1809-4204-9775-f8d971f0e754 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 69

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.468285Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:0e9e306a67622b1a81e7aa43a8269c92ddb2f0ab0b468a16a664c02c01f9c3fd

Observation 737caae7-e131-4865-b120-83794369873e · outbound

This paper cites In23rd USENIX Security Symposium.

Prismata: Confining Cross-Site Prompt Injection in Web Agents In23rd USENIX Security Symposium

Reference 70

Resolution
verified fuzzy
raw_fallback, observed 2026-07-10T12:27:04.466504Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:88554dc1f4dc96caa7b80c0de84948e5bd7fbc5fda7b25243d2ddbb0f25c11c0

Observation 05047864-36a8-4ff6-96fa-7ecc5a30f9e7 · outbound

This paper cites Muzzle: Adaptive agentic red-teaming of web agents against indirect prompt injection attacks.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Muzzle: Adaptive agentic red-teaming of web agents against indirect prompt injection attacks

Reference 71

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.137158Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:c8cbf294a66231de65c7944cb560009f0e7c2f9f1b4c77ba426b3726e51eecff

Observation 102d94c4-3dd0-492e-9b55-2fe3bd25ccd0 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 72

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.415419Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:70c2fc83e93d32843759caf121f7805053325cccba87515afa52380a18e93794

Observation 3015d79e-0d7e-4d34-bc59-f64bed6703a5 · outbound

This paper cites Several-Dream9346.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Several-Dream9346

Reference 73

Resolution
metadata mismatch
arxiv_id, observed 2026-07-10T12:27:04.095082Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:027e9ce3609e005e3c0ff1490c15390448cf93ea6e33531606c996d9421e2c79

Observation 280721ae-b7db-4420-ad02-43e5cd1243b0 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 74

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.413930Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:62aaa2b0753fa5a70c2a0a8846b56bb5feda0fcab736ceae26986c65702d6a3f

Observation e3f2e3fa-8e8d-43ad-9396-f7c8d468f808 · outbound

This paper cites The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions.

Prismata: Confining Cross-Site Prompt Injection in Web Agents The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions

Reference 75

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.239160Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:1358dfa47147381f33a2e9d7f41873bb2f219d87d3f3b46e1c9096538883826d

Observation 593f5839-afb9-4175-822f-a50c9e2e8399 · outbound

This paper cites AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery.

Prismata: Confining Cross-Site Prompt Injection in Web Agents AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery

Reference 76

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.139949Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:23f004b7fcbadeb9373894c32eba8d1fffa72766b7807dc05e412931a1bfdd79

Observation efe5319e-c2a5-4ea8-9d4a-fd3e9f94bf1b · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 77

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.469758Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:5ec0673b8089179c3947bf5d5e196734d030839b63001472d9bbd3838a2ecc0d

Observation aa747bc6-6c7f-4daa-85c4-e0f56b167321 · outbound

This paper cites naacl-long.360/.

Prismata: Confining Cross-Site Prompt Injection in Web Agents naacl-long.360/

Reference 78

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.068851Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:eeed00c3b9859c79ba28c05f5a12e7bf549fb184767b651ed9ddd136ad1cfcee

Observation 5a419fc8-8061-47c1-ae80-015b7a8ff266 · outbound

This paper cites Envinjection: Environmental prompt injection attack to multi-modal web agents.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Envinjection: Environmental prompt injection attack to multi-modal web agents

Reference 79

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.142914Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:e43ddb402c19c20db505fcfbe501a6a7cee9fc718573a304721b968ce3c775da

Observation be2cbff8-bb01-46ab-b495-6eed47a6abd2 · outbound

This paper cites Websentinel: Detecting and localizing prompt injection attacks for web agents.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Websentinel: Detecting and localizing prompt injection attacks for web agents

Reference 80

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.146129Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:d63e2f50ae0709cff4acbcc80a39628d3e5e0f4ce2adea9d632e7b1182a5d3e7

Observation 4284a130-0cc6-49e4-ac64-3454b577a0c2 · outbound

This paper cites Agent Workflow Memory.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Agent Workflow Memory

Reference 81

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.214500Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:a90a43179049ad8ed32e8d40add60b97b176ea16c502164c789fe93a3ae87c22

Observation c6df2688-65a4-4c48-ab96-34c4ff7fd75b · outbound

This paper cites Rl is a hammer and llms are nails: A simple reinforcement learning recipe for strong prompt injection.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Rl is a hammer and llms are nails: A simple reinforcement learning recipe for strong prompt injection

Reference 82

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.244307Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:b6c8a1c011cb514165d818ea03fc6232970a6822c0ed4f92994d27d4fc20a909

Observation 1b60801b-a6aa-42d3-b24f-b11d4d71a40a · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 83

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.410485Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:8e751772ae0d5ca1b249d3a90c456b763fb20bc0c8f51b6d534df68375c808cf

Observation d3ec3667-e441-40ec-9399-ccafe6926c71 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 84

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.471211Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:3487e1405b11fed5549215d66e9a42f3b685d443a650ed9c3e25fbcd467164e1

Observation 35dc037d-3251-4c14-b2a4-73943c510597 · outbound

This paper cites System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective.

Prismata: Confining Cross-Site Prompt Injection in Web Agents System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective

Reference 85

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.231363Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:9a65be142af7f71ff26a912339120225ecf50932872496d3689c037f2f538427

Observation cb960af1-81a6-4e98-a54a-079faccbfd01 · outbound

This paper cites When Bots Take the Bait: Exposing and Mitigating the Emerging Social Engineering Attack in Web Automation Agent,.

Prismata: Confining Cross-Site Prompt Injection in Web Agents When Bots Take the Bait: Exposing and Mitigating the Emerging Social Engineering Attack in Web Automation Agent,

Reference 86

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.103712Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:d009e25e6a2f0d78bf263835e1809d881f7ebced167e6a9e0f0976372b7183c4

Observation 2fe81d14-9813-4695-9bb3-4a11d27154d1 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 87

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.405672Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:9763cecf234756a91d070fe39a00de201e06b43a3ff76450594e19c8a8859953

Observation c9a13f31-a8b4-478e-9db2-77d30dd93cac · outbound

This paper cites AdvAgent: Controllable Blackbox Red-teaming on Web Agents.

Prismata: Confining Cross-Site Prompt Injection in Web Agents AdvAgent: Controllable Blackbox Red-teaming on Web Agents

Reference 88

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.226700Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:5a7bcd97d5277885ccda1dcb0736439ced599c705e636e48fc6a625a414a7e16

Observation 12d728dd-dcde-49c6-9955-2f216d931798 · outbound

This paper cites Xu, Yufan Song, Boxuan Li, et al.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Xu, Yufan Song, Boxuan Li, et al

Reference 89

Resolution
verified fuzzy
raw_fallback, observed 2026-07-10T12:27:04.404226Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:b382bb5b8ddc34c2e752653bd89d27d416e7caeb69274c344b101f682dfd4c83

Observation 41439c36-a94e-403d-939f-c818d5b6d2c8 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 90

Resolution
verified exact
arxiv_id, observed 2026-07-10T12:27:04.052187Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:297122feaff7f80d00682af42cdaeaeb75c16471488c39c8e55a24a664858c2e

Observation 5f1f778f-518f-417c-89f8-17ceac40fee6 · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 91

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.402792Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:d9b043d3bd4e692299b4a3825ba1c533b677439250b462374420e4b3f6ea59fa

Observation 694bbf41-e247-41b9-ad6e-701bbca72553 · outbound

This paper cites Set-of-Mark Prompting Unleashes Extraordinary Visual Grounding in GPT-4V.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Set-of-Mark Prompting Unleashes Extraordinary Visual Grounding in GPT-4V

Reference 92

Resolution
metadata mismatch
local_arxiv, observed 2026-07-10T12:27:04.234120Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:92e54553b8f56a6f41d38d36502b7e281f86e8f3d44ce5f5952a6b1293c223b0

Observation ab21f29e-908f-42b6-ac87-4314f602e0c3 · outbound

This paper cites AgentOccam: A Simple Yet Strong Baseline for LLM-Based Web Agents.

Prismata: Confining Cross-Site Prompt Injection in Web Agents AgentOccam: A Simple Yet Strong Baseline for LLM-Based Web Agents

Reference 93

Resolution
malformed identifier
local_arxiv, observed 2026-07-10T12:27:04.224423Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:b15fc5a026c80305b47a29e8c11b1a0ff2e3aaaa08676958481afcc8f088a7d2

Observation 4c0466ee-3251-48fd-9c94-74ce26b92cab · outbound

This paper cites In-Context Defense in Computer Agents: An Empirical Study.

Prismata: Confining Cross-Site Prompt Injection in Web Agents In-Context Defense in Computer Agents: An Empirical Study

Reference 94

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.106680Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:08e813398becc6ec0e254d610266053a4ca00db23ac00a8662c9826cc86bed11

Observation 236b8136-c51f-4c14-bb1e-30bb05ab5cdf · outbound

This paper cites an unresolved cited work.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Unresolved cited work

Reference 95

Resolution
unresolved
raw_fallback, observed 2026-07-10T12:27:04.401084Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:6557fe429b0be198b6a8337103dbf9b528e905f4ddfea77a8bc9d4163da738dd

Observation 9bdea333-236e-45d2-a5cd-346eb16398e7 · outbound

This paper cites ISBN 979-8-89176-195-7.

Prismata: Confining Cross-Site Prompt Injection in Web Agents ISBN 979-8-89176-195-7

Reference 96

Resolution
verified exact
doi, observed 2026-07-10T12:27:04.126725Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:ea3721b3eada652dd88071d470b9d9a28729dea93f827abee7984943e8dbf051

Observation 6267cd72-2123-43bd-a78a-12204f61f320 · outbound

This paper cites BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents.

Prismata: Confining Cross-Site Prompt Injection in Web Agents BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents

Reference 97

Resolution
verified exact
arxiv_id, observed 2026-08-13T01:24:45.972029Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:a15b55461582220638a9c86343572fceba63e0d4b42e9d0ce5f985a314057a22

Observation 2d2a1655-e1e4-4da2-b4e9-fa2f64318076 · outbound

This paper cites WebPilot: A Versatile and Autonomous Multi-Agent System for Web Task Execution with Strategic Exploration.

Prismata: Confining Cross-Site Prompt Injection in Web Agents WebPilot: A Versatile and Autonomous Multi-Agent System for Web Task Execution with Strategic Exploration

Reference 98

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.079680Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:17264b6f126e996e0a8da5afc5398e4b8bd2dc71994b6fecff7d8ea2b704f970

Observation e4cb4ee9-5f1b-4149-9cf8-5b7143bff42b · outbound

This paper cites Attacking Vision-Language Computer Agents via Pop-ups.

Prismata: Confining Cross-Site Prompt Injection in Web Agents Attacking Vision-Language Computer Agents via Pop-ups

Reference 99

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.206424Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:c72ef35a90062dde9d65d5626e9e38c41a7107f6497646156ac7fa64836f9acf

Observation e33b4044-cd5d-4fb9-a931-f3dfbcbf16fe · outbound

This paper cites WebGuard: Building a Generalizable Guardrail for Web Agents.

Prismata: Confining Cross-Site Prompt Injection in Web Agents WebGuard: Building a Generalizable Guardrail for Web Agents

Reference 100

Resolution
verified exact
local_arxiv, observed 2026-07-10T12:27:04.085771Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.

source=pdf_text observed=2026-07-10T12:20:03.672480Z digest=sha256:504766e23758b5b62deb060b31e17511d1cbb17b36c1d75c53b109697819f926

Pith citing papers

No inbound Pith citation observations are available.